Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 359 of 767

  • 7.2 /10 High
    CVE-2026-87920 No auth

    W3 Total Cache WordPress Plugin - Stored XSS

    W3 Total Cache WordPress plugin <= 2.10.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content via output-buffer regex rewrite, letting unauthenticated attackers inject scripts, exploit requires 'Remove query strings from static resources' option enabled.

  • 9.0 /10 Critical
    CVE-2026-86345

    389-ds-base - Authentication Bypass

    389-ds-base contains a broken authentication caused by improper handling of buffered plaintext bytes during StartTLS negotiation, letting on-path attackers inject crafted LDAP messages causing authentication bypass, exploit requires man-in-the-middle position.

  • 7.5 /10 High
    CVE-2026-85494 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains multiple vulnerabilities including improper length parameter handling, uncaught exceptions, inefficient algorithmic complexity, excessive memory allocation, and insecure resource initialization, letting attackers cause denial of service or resource exhaustion, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-85215 Auth required

    GG Soft Software Services Inc. Paperwork - SQL Injection

    GG Soft Software Services Inc. Paperwork <= 2026-09-09 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-84411 PoC publicNo auth

    RouterOS - Remote Code Execution & Denial of Service

    RouterOS contains an integer underflow in HTTP request body handling, letting unauthenticated network attackers achieve remote code execution as root or cause denial of service using a crafted request.

  • 7.7 /10 High
    CVE-2026-82044 Auth required

    UTMStack - Server-Side Request Forgery

    UTMStack < 11.2.16 contains a server-side request forgery caused by unvalidated URL parameter in PdfService.downloadPdf() method via GET /api/generate-pdf-report, letting authenticated attackers access internal resources and sensitive data.

  • 9.8 /10 Critical
    CVE-2026-82042

    UTMStack - Authentication Bypass

    UTMStack < 11.2.16 contains an authentication bypass caused by acceptance of a valid Utm-Internal-Key header without path restriction or rate limiting in InternalApiKeyFilter, letting remote attackers gain full administrative API access, exploit requires attacker to know INTERNAL_KEY value.

  • 9.9 /10 Critical
    CVE-2026-82041 Auth required

    UTMStack - Command Injection

    UTMStack < 11.2.16 contains a command injection caused by missing authorization checks in UTMIncidentCommandWebsocket.processCommand(), letting authenticated users execute arbitrary OS commands on monitored endpoints, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-82039 Auth required

    UTMStack - SQL Injection

    UTMStack before 11.2.16 contains a sql injection caused by unsanitized assetType and groupName values in UtmAssetGroupService.searchQueryBuilder(), letting authenticated attackers execute arbitrary SQL with DBA privileges via GET /api/utm-asset-groups/searchGroupsByFilter.

  • 7.4 /10 High
    CVE-2026-80443 No auth

    HAVELSAN Inc. Sef - AI Chatbot Platform - Man-in-the-Middle

    HAVELSAN Inc. Sef - AI Chatbot Platform < 2.1 contains an insecure certificate validation vulnerability caused by improper validation, letting adversaries perform man-in-the-middle attacks, exploit requires network access to intercept communications.

  • 8.8 /10 High
    CVE-2026-80298 Auth required

    HAVELSAN Inc. Sef - AI Chatbot Platform - SQL Injection

    HAVELSAN Inc. Sef - AI Chatbot Platform < 2.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 9.4 /10 Critical
    CVE-2026-75937 No auth

    Affected device - Command Injection

    Affected device contains a command injection caused by a specially crafted HTTP POST request to the web administration interface, letting unauthenticated attackers execute arbitrary OS commands with root privileges.

  • 7.5 /10 High
    CVE-2026-67989 No auth

    crmne/ruby_llm - Denial of Service

    crmne/ruby_llm contains a regular expression denial-of-service caused by polynomial-time regex in Mistral model capability matching on Ruby 3.1.x, letting attackers cause denial of service, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-66055 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains an allocation of resources without limits or throttling vulnerability, letting attackers exhaust system resources, exploit requires no special conditions.

  • 8.7 /10 High
    CVE-2026-63772 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability caused by lack of resource management in Go bindings, letting attackers exhaust resources, exploit requires network access.