Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 36 of 891

  • 8.8 /10 High
    CVE-2026-96203 No auth

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows unauthorized attackers to elevate privileges over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96199 No auth

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96198 No auth

    Microsoft Edge - Remote Code Execution

    Microsoft Edge (Chromium-based) contains a heap-based buffer overflow allowing unauthorized attackers to execute code remotely over a network, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-96196 No auth

    Microsoft Edge - Security Feature Bypass

    Microsoft Edge (Chromium-based) contains a security feature bypass caused by an incomplete list of disallowed inputs, letting unauthorized attackers bypass security over a network, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-96192 No auth

    Microsoft Edge - Use After Free

    Microsoft Edge for iOS contains a use after free vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-96187 No auth

    Microsoft Edge - Information Disclosure

    Microsoft Edge (Chromium-based) contains a type confusion vulnerability caused by access of resource using incompatible type, letting unauthorized attackers disclose information over a network, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-9536 No auth

    vtk - Buffer Overflow

    vtk 9.6.1 contains a heap-based buffer overflow caused by improper handling in FindVariableOffsets functionality, letting attackers trigger buffer overflow via a malicious .wind file, exploit requires attacker to provide crafted file.

  • 8.2 /10 High
    CVE-2026-9535 No auth

    vtk - Out-of-Bounds Read

    vtk 9.6.1 contains an out-of-bounds read caused by improper handling of specially crafted chaco files in vtkChacoReader InputGraph2, letting attackers read memory out-of-bounds, exploit requires malicious file input.

  • 7.5 /10 High
    CVE-2026-93904 No auth

    Social Web Suite Social Media Auto Post - SQL Injection

    Social Web Suite Social Media Auto Post, Social Media Auto Publish plugin for WordPress <= 4.1.12 contains a SQL injection caused by insufficient escaping of 'exclude_posts' parameter and bypassable HMAC authentication, letting unauthenticated attackers extract sensitive database information, exploit requires unvisited settings page on fresh install.

  • 7.5 /10 High
    CVE-2026-93855 No auth

    SendPress Newsletters - SQL Injection

    SendPress Newsletters WordPress plugin <= 1.26.1.20 contains a time-based SQL injection caused by insufficient escaping of 'subscriberid' parameter and weak nonce protection, letting unauthenticated attackers extract sensitive database information, exploit requires nonce bypass via public shortcode.

  • 7.5 /10 High
    CVE-2026-93757 Auth required

    Wild Apricot Login - Authentication Bypass

    Wild Apricot Login plugin for WordPress <= 1.0.18 contains an authentication bypass via SSO email-collision account binding caused by insufficient verification in user mapping and session cookie issuance, letting attackers with matching WildApricot email authenticate as WordPress administrators, exploit requires attacker-controlled WildApricot contact with victim's email and SSO login completion.

  • 9.8 /10 Critical
    CVE-2026-93680 PoC publicNo auth

    IBM Langflow OSS - Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.12.8 contains a broken authentication caused by improper authentication, letting remote attackers bypass security restrictions, exploit requires no special conditions.

  • 8.2 /10 High
    CVE-2026-93570 No auth

    Szafir - XML External Entity Injection

    Szafir and Szafir Weryfikująca contain an XML External Entity (XXE) injection caused by processing external entities in crafted XML files with DOCTYPE external DTD references, letting attackers read arbitrary files, exploit requires crafted XML input.

  • 8.7 /10 High
    CVE-2026-92744 PoC public

    Privilege Manager Agent - Remote Code Execution & Privilege Escalation

    Privilege Manager Agent contains a remote code execution caused by improper access control, letting remote unauthenticated attackers execute arbitrary code as LocalSystem, exploit requires specific conditions.

  • 7.4 /10 High
    CVE-2026-92092

    OpenShift Ansible - Command Injection

    OpenShift Ansible installer container contains a command injection caused by downloading and executing remote scripts without integrity verification, letting remote attackers execute arbitrary code with cluster-provisioning privileges, exploit requires network interception or compromised HTTP server.