Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 361 of 767
- 9.8 /10 CriticalCVE-2026-51904 No auth
SuperAGI - Broken Access Control
SuperAGI <= v0.0.14 contains an improper access control vulnerability in agent execution controller caused by lack of verification of agent ownership in create_agent_execution and create_agent_run, letting remote authenticated attackers create or start execution records for agents of other organizations, exploit requires authentication.
- 8.1 /10 HighCVE-2026-51901 Auth required
SuperAGI - Broken Access Control
SuperAGI <= 0.0.14 contains an incorrect access control vulnerability caused by lack of authorization checks on the /api/agentexecutions/schedule endpoint, letting authenticated users schedule agents from other organizations.
- 9.8 /10 CriticalCVE-2026-51898 No auth
sinaptik-ai pandas-ai - Code Injection
sinaptik-ai pandas-ai 3.0.0 contains a code injection caused by improper handling in CodeExecutor.execute, letting attackers execute arbitrary code remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-39718 No auth
Webriti Wallstreet - Cross Site Request Forgery
Webriti Wallstreet <= 2.8.6 contains a cross site request forgery vulnerability caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 9.8 /10 CriticalCVE-2026-19660 PoC publicNo auth
Divi Membership WordPress plugin - Authentication Bypass
Divi Membership WordPress plugin <= 2.3.0 contains an authentication bypass caused by lack of validation in process_paypal_callback function, letting unauthenticated attackers log in as any user including admins, exploit requires crafted paypal_param GET parameter.
- 9.8 /10 CriticalCVE-2026-19652 No auth
Divi Membership - Privilege Escalation
Divi Membership WordPress plugin <= 2.2.0 contains a privilege escalation caused by improper role validation in dmem_form_submit_handler(), letting unauthenticated attackers register as administrators and gain full site control, exploit requires publicly accessible WordPress nonce.
- 8.2 /10 HighCVE-2026-18036
Bouncy Castle - Timing Side-Channel Information Disclosure
Bouncy Castle for Java < 1.86 contains a timing side-channel vulnerability caused by secret-dependent integer division in NTRU polynomial reduction, letting attackers recover private key information via timing analysis, exploit requires precise timing measurement.
- 7.5 /10 HighCVE-2026-17507 No auth
Bouncy Castle - Denial of Service
Bouncy Castle for Java < 1.86 contains a denial of service caused by signed integer misinterpretation of uint32 leaf_index in MLS implementation, letting attackers send crafted messages to exhaust JVM heap, exploit requires membership in group.
- 8.8 /10 HighCVE-2026-15897 Auth required
Super Forms – Drag & Drop Form Builder - Privilege Escalation
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains a privilege escalation caused by lack of ownership and capability checks in Register & Login add-on's before_email_success_msg() and super_save_form AJAX action, letting authenticated users with Subscriber-level access overwrite credentials of arbitrary accounts including administrators, exploit requires authenticated user with Subscriber-level access or higher.
- 9.1 /10 CriticalCVE-2026-15896 No auth
Super Forms – Drag & Drop Form Builder - Path Traversal
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains a path traversal caused by insufficient validation in parse_request function, letting unauthenticated attackers read arbitrary files, exploit requires file upload enabled.
- 9.8 /10 CriticalCVE-2026-14378 PoC publicNo auth
DevKit Pro WordPress plugin - Authentication Bypass
DevKit Pro WordPress plugin <= 2.3.0 contains an authentication bypass caused by improper verification of the original_user_id cookie in revert_switch handler, letting unauthenticated attackers take over administrator accounts by forging cookies and nonces.
- 7.1 /10 HighCVE-2026-105050
PeaZip - Command Injection
PeaZip < 11.3.0 contains a command injection caused by mishandling of quotation characters in filenames within archives, letting attackers execute OS commands, exploit requires non-default configuration.
- 7.1 /10 HighCVE-2026-104991 PoC publicAuth required
Phproject - Broken Access Control
Phproject before 1.8.7 contains a broken access control vulnerability in REST API issue endpoints caused by missing object-level authorization, letting authenticated API key holders read restricted issue data and post unauthorized comments, exploit requires valid API key.
- 8.1 /10 HighCVE-2026-104988 Auth required
Dogtag PKI - Authentication Bypass
Dogtag PKI pki-core contains a broken authentication caused by CMCAuthForEST plugin failing open on EST fullcmc enrollment requests without end-user TLS client certificate, letting authenticated EST users obtain CA-signed certificates with arbitrary subject names, exploit requires authentication.
- 7.1 /10 HighCVE-2026-104912 Auth required
MISP - Broken Access Control
MISP prior to v2.5.48 contains an authorization flaw caused by stale distribution snapshots in correlation handling during attribute searches, letting authenticated users access restricted event attributes and metadata.