Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 369 of 767
- 7.5 /10 HighCVE-2026-86344 No auth
389-ds-base - Denial of Service
389-ds-base contains a denial of service caused by unauthenticated remote attacker sending incomplete LDAPMessage sequences, letting attacker exhaust worker-thread pool and block service, exploit requires network access.
- 7.2 /10 HighCVE-2026-85679 No auth
Extendify WordPress plugin - Stored XSS
Extendify WordPress plugin <= 3.1.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'styles.blocks' block type key, letting unauthenticated attackers inject scripts executed on page access, exploit requires unauthenticated POST, PUT, or PATCH requests to /wp/v2/global-styles.
- 7.2 /10 HighCVE-2026-85235 No auth
Forminator Forms - Stored XSS
Forminator Forms WordPress plugin <= 1.57.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Rich-Text Textarea Field, letting unauthenticated attackers inject scripts executed when an admin interacts with the injected content.
- 9.8 /10 CriticalCVE-2026-82829 No auth
Hitachi Coding Software Suite - Authentication Bypass
Hitachi Coding Software Suite through 3.3.0 contains a broken authentication caused by hidden functionality such as hidden accounts or hardcoded credentials, letting attackers gain unauthorized access, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-82828 Auth required
Hitachi Coding Software Suite - Broken Access Control
Hitachi Coding Software Suite <= 3.3.0 contains an incorrect authorization vulnerability caused by improper access control, letting unprivileged users perform administrator-level operations, exploit requires unprivileged user access.
- 9.8 /10 CriticalCVE-2026-82827 No auth
Hitachi Coding Software Suite - Authentication Bypass
Hitachi Coding Software Suite <= 3.3.0 contains a hardcoded cryptographic key vulnerability caused by hardcoding the JWT signing secret key, letting attackers generate unauthorized Bearer tokens to exploit administrative functions, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-82826 No auth
Hitachi Coding Software Suite - Cleartext Transmission of Sensitive Information
Hitachi Coding Software Suite <= 3.3.0 contains a cleartext transmission of sensitive information vulnerability caused by unencrypted data transmission, letting attackers eavesdrop on authentication credentials and sensitive data in transit, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-82825 No auth
Hitachi Coding Software Suite - Authentication Bypass
Hitachi Coding Software Suite through 3.3.0 contains a broken authentication caused by missing authentication for a critical API, letting unauthenticated attackers retrieve or alter sensitive information or manipulate data.
- 9.8 /10 CriticalCVE-2026-82824 No auth
Hitachi Coding Software Suite - Path Traversal
Hitachi Coding Software Suite through 3.3.0 contains a path traversal vulnerability caused by improper validation of file paths, letting attackers access, create, modify, or delete files, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-81809 No auth
Paytm Payment Gateway WordPress plugin - SQL Injection
Paytm Payment Gateway WordPress plugin < 2.8.9 contains a SQL injection caused by improper escaping of payment callback data and forgable integrity checks, letting unauthenticated attackers execute arbitrary SQL commands.
- 7.5 /10 HighCVE-2026-81739 No auth
Paytm Payment Gateway WordPress - Stored XSS
Paytm Payment Gateway WordPress plugin < 2.8.9 contains a stored XSS caused by unsanitized payment callback data and forged integrity checks, letting unauthenticated users execute scripts in admin sessions, exploit requires gateway enabled without credentials.
- 7.5 /10 HighCVE-2026-80276 No auth
Comelit Multi-User Gateway - Authentication Bypass
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 contain an information disclosure vulnerability caused by an unauthenticated network-accessible management interface, letting remote attackers read sensitive configuration data including the Remote Configuration Password in cleartext, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-80275 Auth required
Comelit Multi-User Gateway - Broken Access Control
Comelit Multi-User Gateway for VIP System (model 1456B) 2.9.1 and 2.10.0 contain a broken access control caused by missing server-side authorization on administrative password-change function, letting authenticated users overwrite administrator passwords, exploit requires user authentication.
- 9.9 /10 CriticalCVE-2026-79901
boks_keytabmd - Authentication Bypass
boks_keytabmd contains a predictable password generation vulnerability caused by seeding with the current Unix timestamp, letting attackers reproduce and verify Active Directory service-account passwords offline, exploit requires knowledge of service principal and password-change time estimation.
- 7.9 /10 HighCVE-2026-79899 Auth required
Fortra BoKS Manager - Information Disclosure
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert caused by predictable temporary file creation without restrictive umask, letting local users access CA secret or host private keys, exploit requires local access to BOKS_tmp directory.