Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 370 of 767
- 9.1 /10 CriticalCVE-2026-79898 Auth required
Fortra BoKS Manager - Command Injection
Fortra BoKS Manager contains a command injection caused by shell command substitution in crlserver, letting authenticated users with CRL URL addition privileges execute commands as root, exploit requires user authentication with specific privileges.
- 7.5 /10 HighCVE-2026-79896 No auth
Fortra BoKS Manager - Denial of Service
Fortra BoKS Manager contains an out-of-bounds read caused by a malformed TLS ClientHello in boks_portmux, letting remote unauthenticated attackers cause service interruption, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-75957 No auth
Ultimate Multisite WordPress - Authentication Bypass
Ultimate Multisite WordPress plugin <= 2.15.0 contains an authentication bypass caused by improper validation in the checkout_form parameter in login_customer_after_checkout, letting unauthenticated attackers log in as any user by knowing their email, exploit requires targeted user to have no pre-existing Ultimate Multisite customer record.
- 8.4 /10 HighCVE-2026-73975 Auth required
djehuty - SQL Injection
djehuty < 26.3.2 contains a SPARQL injection caused by crafted session name in state-modifying queries, letting authenticated depositors write and delete arbitrary triples in the shared RDF store, exploit requires logged-in account.
- 7.3 /10 HighCVE-2026-73637 No auth
Apache HTTP Server - Authentication Bypass
Apache HTTP Server < 2.4.69 contains a use after free vulnerability in mod_auth_digest caused by concurrent Digest authentication requests with AuthDigestNcCheck enabled or AuthDigestNonceLifetime set to 0, letting unauthenticated remote clients cause authentication state corruption.
- 8.1 /10 HighCVE-2026-73636
Apache HTTP Server - Authentication Bypass
Apache Software Foundation Apache HTTP Server 2.4.x contains an authentication bypass caused by replaying captured digest authentication credentials via crafted requests triggering garbage collection in mod_auth_digest, letting man-in-the-middle attackers bypass authentication, exploit requires AuthDigestNonceLifetime set to 0.
- 8.8 /10 HighCVE-2026-70650 No auth
GetSimple CMS - Stored XSS
GetSimple CMS CE <= 3.3.22 contains a stored XSS caused by improper re-encoding in the page backup viewer (admin/backup-edit.php), letting authenticated users execute JavaScript in admin browsers, exploit requires page edit privileges.
- 7.5 /10 HighCVE-2026-68496 No auth
FasterXML jackson-dataformats-binary - Denial of Service
FasterXML jackson-dataformats-binary < 2.16.0 contains a denial of service caused by missing maxNameLength enforcement in Smile parser property name decoding, letting attackers exhaust memory by submitting large property names, exploit requires ability to submit data to a parsing endpoint.
- 7.5 /10 HighCVE-2026-68495 No auth
FasterXML jackson-dataformats-binary - Denial of Service
FasterXML jackson-dataformats-binary < 2.16.0 contains a denial of service caused by missing maxNameLength validation in CBOR parser property name decoding, letting attackers submit crafted CBOR documents to exhaust memory, exploit requires ability to submit data to parsing endpoint.
- 7.4 /10 HighCVE-2026-67105
HCL BigFix Service Management - Insecure Communication
HCL BigFix Service Management contains an insecure communication vulnerability caused by unencrypted HTTP traffic between backend services, letting attackers with internal network access intercept sensitive data and perform man-in-the-middle attacks, exploit requires internal network access.
- 8.8 /10 HighCVE-2026-66246 Auth required
iControl - Broken Access Control
iControl contains a broken access control vulnerability caused by missing authentication checks or insecure direct object references (IDOR), letting attackers escalate privileges and modify or delete sensitive data, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-63718 No auth
Apache HTTP Server - HTTP Request/Response Smuggling
Apache HTTP Server 2.4.30 through 2.4.68 contains an HTTP request/response smuggling vulnerability caused by inconsistent interpretation of HTTP requests in mod_proxy_uwsgi with crafted uwsgi responses, letting remote attackers perform request smuggling.
- 7.5 /10 HighCVE-2026-63686 No auth
Apache HTTP Server - Denial of Service
Apache HTTP Server < 2.4.69 contains a null pointer dereference caused by improper handling of proxied responses with partially failing charset conversion in mod_xml2enc, letting untrusted backend servers cause denial of service.
- 7.5 /10 HighCVE-2026-63292 PoC publicNo auth
Apache HTTP Server - Buffer Overflow
Apache HTTP Server through 2.4.68 contains a stack-based buffer overflow caused by an HTTP Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised, letting remote clients cause denial of service or execute arbitrary code.
- 7.5 /10 HighCVE-2026-63045
Apache HTTP Server - Open Proxy
Apache Software Foundation Apache HTTP Server <= 2.4.68 contains an open proxy vulnerability caused by improper validation of FTP PASV reply address in mod_proxy_ftp, letting untrusted FTP servers cause the proxy to connect to arbitrary third-party hosts, exploit requires forward proxy configuration.