Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 32 of 677
- 7.5 /10 HighCVE-2026-109527 No auth
Model Context Protocol Python SDK - Denial of Service
Model Context Protocol Python SDK < 1.29.1 and 2.0.0a1 through 2.0.1 contain a denial of service caused by unbounded buffering of HTTP request bodies in Streamable HTTP session manager and related components, letting unauthenticated remote clients exhaust server memory, exploit requires network access to affected endpoints.
- 9.8 /10 CriticalCVE-2026-109439 No auth
Lantronix XPress-DR - Authentication Bypass
Lantronix XPress-DR and XPress-DR-I firmware through 8.1.0.0 contain a missing authentication vulnerability caused by unauthenticated UDP configuration protocol on port 30718, letting remote attackers read and overwrite device configuration persistently, exploit requires network access to UDP port 30718.
- 7.1 /10 HighCVE-2026-108484 No auth
WPManageNinja Best Payments Plugin for WP - Stored XSS
WPManageNinja Best Payments Plugin for WP <= 4.6.27 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-108483 No auth
hippooo Hippoo Mobile App for WooCommerce - Reflected XSS
hippooo Hippoo Mobile App for WooCommerce <= 1.12.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-108480 No auth
Skydropx Skydropx - Broken Access Control
Skydropx Skydropx <= 2.1.4 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.
- 8.7 /10 HighCVE-2026-108473 No auth
Kasa Devices - Broken Access Control
Kasa devices contain an improper authentication vulnerability in the local device-management protocol, letting unauthenticated adjacent attackers modify device state or management settings and potentially expose account information under certain conditions.
- 7.5 /10 HighCVE-2026-108395 No auth
Model Context Protocol Java SDK - Denial of Service
Model Context Protocol Java SDK 0.8.0 through 0.12.0 (mcp), 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 (mcp-core), and 2.0.0-M1 through 2.0.0 (mcp-core) contains a denial of service caused by unbounded HTTP request body reading in Servlet-based SSE, Streamable HTTP, and Stateless server transports, letting unauthenticated remote clients exhaust server heap memory, exploit requires network access to affected transports.
- 9.9 /10 CriticalCVE-2026-108390 Auth required
Hestia Control Panel - Command Injection
Hestia Control Panel 1.9.7 through 1.10.4 contains a command injection caused by improper escaping of single quotes in update_object_value() when writing custom document-root values, letting low-privileged authenticated users execute code as root via a crafted PATH during the Search feature.
- 7.4 /10 HighCVE-2026-108337 Auth required
Application - Authentication Bypass
An application contains a broken authentication vulnerability caused by exposure of password reset codes in an admin-only API, letting administrators reset any user's password, exploit requires administrative access.
- 9.1 /10 CriticalCVE-2026-108336 No auth
Application - Authentication Bypass
An application using a default self-signed SSL certificate to sign JWT access tokens contains a broken authentication vulnerability, letting attackers bypass login and gain administrative access, exploit requires use of default certificate.
- 9.1 /10 CriticalCVE-2026-108335 No auth
Application - Authentication Bypass
An application with password reset functionality and email configured contains a brute force vulnerability due to lack of rate limiting on reset code attempts, letting attackers gain administrative access, exploit requires enabled password reset and email configuration.
- 9.8 /10 CriticalCVE-2026-108291 No auth
itthinx Affiliates - Insecure Deserialization
itthinx Affiliates <= 7.0.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.7 /10 HighCVE-2026-108071 Auth required
TSplus Remote Access - Authentication Bypass
TSplus Remote Access contains an authentication bypass caused by improper multi-factor authentication validation, letting remote attackers with valid first-factor credentials bypass second-factor verification and access protected resources.
- 8.7 /10 HighCVE-2026-108070 No auth
TSplus Remote Access - Broken Access Control
TSplus Remote Access contains a broken access control caused by manipulated paths in /socket.io/JWN/ endpoint, letting unauthenticated remote attackers access protected internal resources.
- 9.8 /10 CriticalCVE-2026-108065 No auth
Channel Software WebAlliance eCommerce - SQL Injection
Channel Software WebAlliance eCommerce contains a SQL injection caused by improper sanitization of the sUserID parameter in the SOAP GetUser method at /preapproval.asmx, letting unauthenticated remote attackers read, write, and execute commands on the backend Microsoft SQL Server, exploit requires crafted sUserID parameter with SQL injection payload.