Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 351 of 767
- 8.8 /10 HighCVE-2026-93549 No auth
CoCart WordPress plugin - Cross-Site Request Forgery
CoCart WordPress plugin < 4.9.7 contains a cross-site request forgery vulnerability caused by improper scoping of REST API authentication filter, letting attackers create new administrator accounts via logged-in admin sessions.
- 7.5 /10 HighCVE-2026-88779 CISA KEV
CVE-2026-88779
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
- 7.4 /10 HighCVE-2026-105222
alexpechkarev/google-maps - Man-in-the-Middle
alexpechkarev/google-maps Laravel package through 12.16 contains a man-in-the-middle vulnerability caused by disabling TLS certificate verification via ssl_verify_peer set to FALSE, letting on-path attackers intercept requests, steal API keys, and tamper with responses, exploit requires network interception capability.
- 7.4 /10 HighCVE-2026-105221 PoC public
Gist RubyGem - Improper Certificate Validation
Gist RubyGem < 6.1.0 contains an improper certificate validation vulnerability caused by VERIFY_NONE setting in http_connection in lib/gist.rb, letting on-path attackers intercept and modify HTTPS traffic, exploit requires network interception capability.
- 7.8 /10 HighCVE-2026-105220 No auth
Twine 2 desktop - Stored XSS
Twine 2 desktop <= 2.12.0 contains a stored XSS caused by execution of markup from imported story files in importStories(), letting attackers execute code as the user via crafted story files, exploit requires opening malicious story files.
- 7.5 /10 HighCVE-2026-105219 No auth
Mammoth.js - Denial of Service
Mammoth.js > 1.3.0 < 1.12.3 contains a denial of service caused by overlapping regex alternatives in the style map tokeniser in lib/styles/parser/tokeniser.js, letting attackers block the Node.js event loop by supplying crafted .docx files.
- 7.4 /10 HighCVE-2026-105218 No auth
gopay - Man In The Middle
gopay before 1.5.119 contains a man-in-the-middle vulnerability caused by disabled TLS certificate verification in defaultClient() in pkg/xhttp/client.go, letting attackers impersonate payment provider APIs and intercept or modify sensitive data, exploit requires network access.
- 7.4 /10 HighCVE-2026-105216 No auth
go-micro - Man-in-the-Middle
go-micro < 6.0.0 contains a man-in-the-middle vulnerability caused by improper certificate validation with InsecureSkipVerify set to true by default, letting network attackers intercept or modify service traffic, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-105215 No auth
ZITADEL - Authentication Bypass
ZITADEL < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by trusting client-supplied external identity fields without completed IdP callback in hosted Login V1 UI, letting unauthenticated attackers pre-create accounts bound to victim's external IdP identity.
- 8.2 /10 HighCVE-2026-105213 No auth
ZITADEL - Authentication Bypass
ZITADEL < 4.17.1 contains a broken authentication caused by not checking an organization's inactive state during Login V2, letting users of deactivated organizations sign in and obtain tokens, exploit requires valid user credentials or session.
- 7.5 /10 HighCVE-2026-105212 No auth
ZITADEL - Authentication Bypass
ZITADEL 3.x < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by acceptance of passkey or authenticator enrollment on identify-only login sessions before primary factor verification, letting unauthenticated attackers log in as users, exploit requires knowledge of victim's login name.
- 8.1 /10 HighCVE-2026-105211 No auth
ZITADEL - Authentication Bypass
ZITADEL < 4.17.1 contains an authentication bypass caused by OTP code exposure via returnCode delivery type in Login V2, letting unauthenticated attackers take over accounts including administrators, exploit requires victim to have OTP-Email and OTP-SMS enrolled.
- 8.2 /10 HighCVE-2026-105210 No auth
ZITADEL - Authentication Bypass
ZITADEL 3.x < 3.4.15 and 4.x < 4.17.1 contain a broken authentication caused by missing primary factor verification in hosted Login V1 UI second-factor enrollment, letting attackers enroll factors and enumerate users knowing only login names.
- 9.6 /10 CriticalCVE-2026-105209 Auth required
ZITADEL - Broken Access Control
ZITADEL 3.x < 3.4.15 and 4.x < 4.17.1 contain an improper authorization vulnerability caused by insufficient organization verification in passkey or passwordless enrollment code issuance, letting attackers with user-write permission in one organization take over accounts in another organization, exploit requires user-write permission in one organization.
- 7.7 /10 HighCVE-2026-105208 Auth required
ZITADEL - Broken Access Control
ZITADEL 4.x < 4.17.3 and 3.x <= 3.4.15 contain a broken access control vulnerability caused by unauthenticated, malleable encryption of IdP intent tokens, letting authenticated users tamper tokens to hijack other users' external login intents, exploit requires predicting victim's intent identifier and winning a timing race.