Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 340 of 767

  • 9.8 /10 Critical
    CVE-2026-88395 No auth

    GouGuOA - SQL Injection

    GouGuOA <= 6.0.5 contains a sql injection caused by unsanitized keywords parameter in /home/message/rubbish, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-88394 No auth

    WookTeam - Path Traversal

    WookTeam <= 1.6.6 contains a path traversal caused by lack of path normalization in /api/project/task/export endpoint, letting remote attackers download arbitrary files readable by the web server, exploit requires crafted JSON payload.

  • 9.8 /10 Critical
    CVE-2026-88393 No auth

    WookTeam - Remote Code Execution

    WookTeam <= 1.6.6 contains a remote code execution caused by unsafe eval of base64-decoded data parameter in /api/project/task/export, letting attackers execute arbitrary PHP code remotely, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-88392 No auth

    Unimall - Directory Traversal

    Unimall v4 contains a directory traversal caused by improper validation in FileUploadController.local(), letting attackers execute arbitrary code remotely, exploit requires crafted file upload.

  • 9.8 /10 Critical
    CVE-2026-88391 No auth

    Northstar - Remote Code Execution

    Northstar <= 9.1.1 contains a remote code execution caused by exposed H2 Console without authentication and default credentials, letting network-reachable attackers execute arbitrary system commands pre-authentication.

  • 8.4 /10 High
    CVE-2026-86671 Auth required

    Eclipse Che - Server Side Request Forgery

    Eclipse Che >= 7.29.0 contains a server-side request forgery caused by lack of scheme and host allow-list in URLFetcher.fetch(), letting authenticated users read local files, access internal services, and exfiltrate SCM tokens via crafted URLs or malicious devfiles.

  • 9.0 /10 Critical
    CVE-2026-79820 No auth

    HPE Integrated Lights-Out (iLO) 7 - Authentication Bypass

    HPE Integrated Lights-Out (iLO) 7 firmware contains a user validation failure vulnerability, letting remote attackers bypass authentication, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-78861

    Mercusys AC12 - Remote Code Execution

    Mercusys AC12 V2 contains a remote code execution caused by a hardcoded 512-bit RSA Private Key, letting local attackers execute arbitrary code, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-78860 Auth required

    Mercusys AC12 V2 - Remote Code Execution

    Mercusys AC12 V2 contains a local code execution vulnerability caused by storage of information in plaintext, letting local attackers execute arbitrary code, exploit requires local access.

  • 7.9 /10 High
    CVE-2026-77805 Auth required

    In Progress Telerik Fiddler Classic - Privilege Escalation

    In Progress Telerik Fiddler Classic for Windows < 6.0.20262.10021 contains a privilege escalation caused by insufficient integrity checks on external helper tools, letting local low-privilege attackers execute unintended code with elevated privileges, exploit requires user to launch the tool and approve elevation prompt.

  • 8.1 /10 High
    CVE-2026-77226 No auth

    Camunda - Broken Access Control

    Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability caused by improper admin group membership checks in the Admin web application's first-run setup endpoint, letting unauthenticated remote attackers create admin accounts, exploit requires camunda-admin group to be empty while system is administered.

  • 8.5 /10 High
    CVE-2026-63277 PoC publicNo auth

    LibreOffice Calc - Remote Code Execution

    LibreOffice Calc contains a remote code execution vulnerability caused by loading a Java database driver from a remote location via external data source links, letting attackers execute Java code remotely, exploit requires opening a crafted document.

  • 7.0 /10 High
    CVE-2026-58880 Auth required

    Bluetooth Stack - Race Condition

    Bluetooth stack in handle_app_val_response of btif_rc.cc contains a race condition leading to code execution, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-58865 No auth

    PduParser - Denial of Service

    PduParser contains a persistent denial of service caused by missing bounds checks in multiple functions, letting remote attackers cause denial of service without requiring user interaction.

  • 7.8 /10 High
    CVE-2026-58859 Auth required

    Unknown - Denial of Service & Privilege Escalation

    Unknown product contains a denial of service caused by uncaught exceptions in multiple places, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.