Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 3 of 891

  • 8.7 /10 High
    CVE-2026-8923 Auth required

    Zohocorp ManageEngine Eventlog Analyzer & Log360 - Remote Code Execution

    Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 < 13062 contain an authenticated remote code execution caused by Log Forward option, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

  • 9.1 /10 Critical
    CVE-2026-88811 No auth

    SUSE Rancher Manager - Information Disclosure

    SUSE Rancher Manager 2.13.0 to 2.13.11, 2.14.0 to 2.14.7, and 2.15.0 to 2.15.3 contains an information disclosure vulnerability caused by missing filtering in the meta proxy, letting attackers leak rancher credentials to cloud providers, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-88810 Auth required

    SUSE Rancher - Privilege Escalation

    SUSE Rancher 2.15.2 and SUSE Rancher Webhook 0.11.0 to 0.11.4, 0.12.0 to 0.12.1 contain a privilege escalation caused by lack of validation on inheritedNamespacedRules in GlobalRole, letting non-administrative users gain excessive permissions in downstream clusters via global role binding, exploit requires user to have a global role binding.

  • 7.6 /10 High
    CVE-2026-88809 Auth required

    SUSE Rancher Manager - Open Proxy

    SUSE Rancher Manager 2.11.0 to 2.15.3 contains an open proxy vulnerability caused by improper allowlist enforcement in the /meta/proxy endpoint, letting remote attackers forward requests to unauthorized destinations, exploit requires network access to the proxy endpoint.

  • 9.8 /10 Critical
    CVE-2026-86596 CISA KEVPoC publicNo auth

    s2Member WordPress plugin - Remote Code Execution

    s2Member WordPress plugin <= 260927 contains a remote code execution caused by insufficient sanitization in strip_php_tags_deep() and post-interpolation placeholder cleanup in 'item_name' parameter, letting authenticated attackers with custom-level access execute code on the server.

  • 7.7 /10 High
    CVE-2026-81938 Auth required

    Grafana Mimir - Information Disclosure

    Grafana Mimir < 3.1.7 and < 3.2.2 contains a file read vulnerability caused by insufficient validation of http_headers.<name>.files and basic_auth.username_file in Alertmanager tenant configurations, letting tenants with config upload permission read arbitrary files on the Alertmanager host by directing receivers to attacker-controlled servers.

  • 8.4 /10 High
    CVE-2026-77880 No auth

    Control Web Panel - Command Injection

    Control Web Panel (CWP) < 1.16 contains a command injection caused by unescaped 'user' parameter in /newpass/ API, letting remote attackers execute arbitrary OS commands as root, exploit requires crafted POST request.

  • 7.7 /10 High
    CVE-2026-77879 No auth

    Control Web Panel - SQL Injection

    Control Web Panel (CWP) < 1.16 contains a SQL injection caused by interpolation of attacker-controlled authorization_code and client_id parameters in loopback API authentication gate access_token(), letting attackers read arbitrary database contents and bypass authentication, exploit requires crafted API requests.

  • 8.4 /10 High
    CVE-2026-77878

    Control Web Panel - Command Injection

    Control Web Panel (CWP) < 1.30 contains an OS command injection caused by improper escaping of attacker-controlled file path in /v1/restoredatabase/ API, letting remote attackers execute arbitrary commands as root, exploit requires access to the restore database API.

  • 8.4 /10 High
    CVE-2026-77877 No auth

    Control Web Panel - Authentication Bypass

    Control Web Panel (CWP) < 1.30 contains a missing authentication vulnerability caused by lack of access token verification in loopback API service, letting attackers invoke root-privileged API routes without authentication.

  • 9.8 /10 Critical
    CVE-2026-77876 No auth

    Control Web Panel - Command Injection

    Control Web Panel (CWP) < 1.16 contains a command injection caused by unescaped input in the protected_directory user panel module's file POST parameter in acc=deletedp action, letting attackers execute arbitrary commands in user panel context, exploit requires crafted POST request.

  • 7.5 /10 High
    CVE-2026-74993 No auth

    Starnet Computer and Network Systems Inventory Tracking Application - SQL Injection

    Starnet Computer and Network Systems Inventory Tracking Application through 2026-10-16 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-73697 Auth required

    Control Web Panel - Remote Code Execution

    Control Web Panel (CWP) < 1.16 contains arbitrary file write and OS command injection vulnerabilities in the phpini_editor user panel module, letting authenticated attackers write files and execute OS commands remotely, exploit requires module access.

  • 9.1 /10 Critical
    CVE-2026-73696 No auth

    Control Web Panel - Authentication Bypass

    Control Web Panel (CWP) < 1.12 contains an execution after redirect vulnerability caused by missing exit() after redirect in user panel authentication flow, letting attackers with valid hosting usernames bypass authentication and execute code, exploit requires valid hosting username.

  • 8.8 /10 High
    CVE-2026-73695 Auth required

    Control Web Panel - Path Traversal

    Control Web Panel (CWP) < 1.16 contains a path traversal vulnerability caused by unsanitized module name concatenation in services/users/index.php, letting attackers include arbitrary local PHP files, exploit requires crafted module name.