Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 355 of 767

  • 8.7 /10 High
    CVE-2026-71888

    Bouncy Castle - Authentication Bypass

    Bouncy Castle for Java < 1.86 contains an authentication bypass caused by inconsistent handling of digestAlgorithm and authAttrs fields in CMS AuthenticatedData parser, letting attackers modify authenticated attributes without key access, exploit requires message modification in transit.

  • 8.2 /10 High
    CVE-2026-71887 No auth

    Bouncy Castle - Authentication Bypass

    Bouncy Castle for Java < 1.86 contains a broken authentication caused by improper validation of OpenPGP subkey binding signatures lacking embedded Primary Key Binding signatures, letting attackers misattribute genuine signatures to attacker-chosen identities, exploit requires attacker to have victim's public signing subkey.

  • 8.2 /10 High
    CVE-2026-71886 No auth

    Bouncy Castle - Broken Access Control

    Bouncy Castle for Java < 1.86 contains a broken access control vulnerability caused by improper validation of certification key flags in OpenPGP certificate API, letting attackers with compromised subkeys issue unauthorized certifications or trust delegations, exploit requires compromised subkey.

  • 9.2 /10 Critical
    CVE-2026-71885

    Bouncy Castle - Authentication Bypass

    Bouncy Castle for Java < 1.86 contains a broken authentication caused by improper binding of X.509 credentials to LeafNode signature_key in MLS implementation, letting unauthenticated attackers impersonate others and decrypt group messages, exploit requires deployment admitting external commits without independent credential checks.

  • 8.2 /10 High
    CVE-2026-71883

    Bouncy Castle - Information Disclosure

    Bouncy Castle for Java LTS before 2.73.13 contains an information disclosure vulnerability caused by improper JNI ReleaseByteArrayElements usage in native packet ciphers, letting attackers obtain raw AES keys when encrypting in place, exploit requires using affected native ciphers with in-place encryption.

  • 8.8 /10 High
    CVE-2026-18443 Auth required

    Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management - SQL Injection

    Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress <= 8.97.0 contains a SQL injection caused by insufficient escaping of 'access_privileges' parameter, letting authenticated subscriber-level attackers extract sensitive database information, exploit requires specific admin deny-list configuration.

  • 8.6 /10 High
    CVE-2026-105115 No auth

    OpenAM - Insecure Deserialization

    OpenAM before 16.1.3 contains an insecure deserialization vulnerability in the legacy JAX-RPC SOAP interface, letting remote attackers instantiate arbitrary classes without authentication, exploit requires sending crafted SOAP requests.

  • 9.8 /10 Critical
    CVE-2026-105105

    NASA-AMMOS AIT-Core - Authentication Bypass

    NASA-AMMOS AIT-Core <= 3.1.1 contains missing authentication for critical functions caused by unauthenticated ZeroMQ message bus sockets binding to all interfaces, letting unauthenticated remote attackers inject or exfiltrate spacecraft command and telemetry data, exploit requires network access to TCP ports 5559 or 5560.

  • 9.9 /10 Critical
    CVE-2026-105080 PoC publicAuth required

    ConvertX - Command Injection

    ConvertX < 0.19.0 contains a command injection caused by passing unblocked .recipe or .downloaded_recipe files to the ebook-convert program, letting attackers execute arbitrary code, exploit requires crafted recipe files.

  • 7.1 /10 High
    CVE-2026-104478 Auth required

    Formwork - Path Traversal

    Formwork < 2.3.13 contains a path traversal caused by base64-encoded backslash-separated traversal payload in BackupController, letting authenticated panel users read or delete arbitrary files, exploit requires backup download or delete permission.

  • 7.5 /10 High
    CVE-2026-104433 No auth

    Mooncake Transfer Engine - Denial of Service

    Mooncake transfer engine < 0.3.12 contains an out-of-bounds read caused by improper handling of zero-length handshake frames in readString function, letting unauthenticated attackers crash the service remotely.

  • 7.5 /10 High
    CVE-2026-103913 No auth

    GeoDirectory WordPress Plugin - SQL Injection

    GeoDirectory WordPress plugin <= 2.8.186 contains a SQL injection caused by insufficient escaping and lack of numeric validation on stored latitude/longitude coordinates, letting authenticated attackers with Subscriber-level access extract sensitive database information.

  • 7.5 /10 High
    CVE-2026-103514 Auth required

    WP 2FA WordPress plugin - Authentication Bypass

    WP 2FA WordPress plugin < 4.1.0 contains a broken authentication caused by failure to invalidate time-based one-time passcodes after use, letting attackers replay valid codes to bypass two-factor authentication, exploit requires attacker to know account password and observe valid code.

  • 7.1 /10 High
    CVE-2026-103342 No auth

    Unlimited Elements Unlimited Elements For Elementor - Reflected XSS

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.20 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.

  • 8.2 /10 High
    CVE-2026-103065 No auth

    Themeum Kirki - Broken Access Control

    Themeum Kirki <= 6.3.1 contains an access control vulnerability caused by improper validation of specified quantity in input, letting attackers access functionality not properly constrained by ACLs, exploit requires no special privileges.