Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 371 of 767

  • 7.5 /10 High
    CVE-2026-62073 No auth

    WP Full Stripe Free - Broken Access Control

    WP Full Stripe Free <= 8.5.6 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted functionality, exploit requires no authentication.

  • 9.3 /10 Critical
    CVE-2026-62071 No auth

    WordPress File Upload - SQL Injection

    WordPress File Upload <= 5.1.10 contains an SQL injection caused by unsanitized input in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-62060 Auth required

    captivateaudio Captivate Sync - SQL Injection

    captivateaudio Captivate Sync <= 3.3.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-62059 PoC publicAuth required

    Ultimate Member Ultimate Member - SQL Injection

    Ultimate Member Ultimate Member <= 2.13.1 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-59797 No auth

    Apache HTTP Server - Broken Access Control

    Apache HTTP Server 2.4.0 through 2.4.68 contains an improper privilege management vulnerability caused by mod_ssl's SSLRequire and file-related expressions, letting attackers bypass intended access controls, exploit requires crafted expressions.

  • 7.5 /10 High
    CVE-2026-59685 No auth

    Apache HTTP Server - Out of Bounds Write

    Apache HTTP Server 2.4.0 through 2.4.68 contains an out-of-bounds write caused by processing paths with 8.3 names on Windows, letting attackers cause memory corruption, exploit requires crafted path input.

  • 9.8 /10 Critical
    CVE-2026-57941 No auth

    Apache HTTP Server - Use After Free

    Apache HTTP Server 2.4.0 through 2.4.68 contains a use after free vulnerability caused by shared session->bbtmp re-entrancy in mod_http2, letting attackers cause memory corruption or denial of service, exploit requires crafted HTTP/2 requests.

  • 9.6 /10 Critical
    CVE-2026-56662 No auth

    GetSimple CMS CE - Cross-Site Request Forgery & Remote Code Execution

    GetSimple CMS CE < 1.5 contains a cross-site request forgery caused by missing anti-CSRF token and request-origin verification in the UpdateCE update form, letting remote attackers execute arbitrary code via administrator session, exploit requires administrator authentication.

  • 7.5 /10 High
    CVE-2026-56661 Auth required

    GetSimple CMS CE - Server Side Request Forgery

    GetSimple CMS CE < 1.5 contains a server-side request forgery caused by insufficient validation of user-supplied URLs in the update handler, letting attackers retrieve internal service responses, exploit requires form submission.

  • 9.1 /10 Critical
    CVE-2026-56660 Auth required

    GetSimple CMS CE - Remote Code Execution

    GetSimple CMS CE < 1.5 contains a remote code execution caused by unsafe ZIP archive extraction and directory traversal in UpdateCE.php, letting attackers execute arbitrary PHP code as the web-server user, exploit requires processing a malicious archive.

  • 7.2 /10 High
    CVE-2026-56589 No auth

    HCL BigFix Service Management - Stored XSS

    HCL BigFix Service Management contains a stored XSS caused by improper sanitization of user input, letting attackers inject malicious scripts that execute when victims view affected pages, enabling session hijacking.

  • 7.5 /10 High
    CVE-2026-56449 No auth

    Apache HTTP Server - Out of Bounds Write

    Apache HTTP Server 2.4.0 through 2.4.68 contains an out-of-bounds write caused by crafted HTTP response bodies in mod_proxy_html, letting remote attackers corrupt memory, exploit requires crafted HTTP response.

  • 9.8 /10 Critical
    CVE-2026-56154 No auth

    Apache HTTP Server - Use After Free

    Apache HTTP Server 2.4.0 through 2.4.68 contains a use after free vulnerability caused by improper handling of lookahead (%{LA-U:HTTP:...}) in mod_rewrite, letting attackers cause denial of service or potentially execute code, exploit requires crafted requests.

  • 7.5 /10 High
    CVE-2026-56153 No auth

    Apache HTTP Server - Out of Bounds Write

    Apache HTTP Server 2.4.0 through 2.4.68 contains an out-of-bounds write caused by improper memory handling in mod_charset_lite, letting attackers potentially corrupt memory, exploit requires crafted requests.

  • 7.6 /10 High
    CVE-2026-55232 Auth required

    Vvveb - Server Side Request Forgery

    Vvveb < 1.0.8.6 contains a server side request forgery caused by improper IPv6 handling in SSRF guard and oEmbed proxy, letting authenticated admin users read internal services and cloud metadata via IPv6 or AAAA-only domains.