Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 373 of 767
- 9.1 /10 CriticalCVE-2026-51879 No auth
deeptutor - Authorization Bypass
deeptutor 1.4.0 contains an authorization bypass caused by user-controlled object identifier in TutorBotManager.write_bot_file, letting remote attackers overwrite whitelisted control files, exploit requires remote access.
- 9.1 /10 CriticalCVE-2026-51876 No auth
DeepTutor - Authorization Bypass
DeepTutor 1.4.0 contains an authorization bypass caused by reuse of publicly exposed book_id in the book confirmation flow, letting unauthenticated or unauthorized callers overwrite persisted metadata and spine content.
- 9.1 /10 CriticalCVE-2026-51875 No auth
Devika - Path Traversal
Devika v1.0 contains a path traversal vulnerability caused by improper validation in the save_code_to_project function, letting attackers write files outside the project workspace, potentially compromising the server.
- 7.5 /10 HighCVE-2026-51874 No auth
Devika - Path Traversal
Devika v1.0 contains a path traversal vulnerability caused by improper validation in the Patcher Agent save_code_to_project function, letting attackers write files outside the intended project workspace, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-51873 Auth required
Devika - Directory Traversal
Devika v1.0 contains a directory traversal caused by improper validation in Coder.save_code_to_project function, letting attackers write files outside the intended project workspace, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-48005 No auth
Apache HTTP Server - Authentication Bypass
Apache Software Foundation Apache HTTP Server < 2.4.69 contains a denial of service caused by missing authentication checks in mod_auth_digest, letting unauthenticated remote clients cause forced re-authentication via forged Authorization headers when Digest authentication with AuthDigestNcCheck is enabled, exploit requires Digest authentication enabled with AuthDigestNcCheck.
- 7.5 /10 HighCVE-2026-47360
Apache HTTP Server - Exposure of Sensitive Information
Apache HTTP Server 2.4.0 through 2.4.68 contains an information disclosure vulnerability caused by SessionCookieRemove changes across internal redirects in mod_session_cookie module, letting unauthorized actors access session cookies, exploit requires internal redirects.
- 7.5 /10 HighCVE-2026-46729 No auth
Apache HTTP Server - Null Pointer Dereference
Apache HTTP Server 2.4.0 through 2.4.68 contains a null pointer dereference caused by improper handling in mod_heartmonitor unicast listener, letting attackers cause denial of service, exploit requires network access.
- 8.8 /10 HighCVE-2026-19807 Auth required
ByteCoreStack MCP Connector for AI Tools - Privilege Escalation
ByteCoreStack MCP Connector for AI Tools WordPress plugin <= 1.2.3 contains a privilege escalation caused by insufficient meta key protection in wp_update_user_meta within execute_tool, letting authenticated subscribers escalate to administrator via MCP JSON-RPC, exploit requires subscriber-level access.
- 8.7 /10 HighCVE-2026-19253 No auth
Cache Enabler WordPress Plugin - Path Traversal
Cache Enabler WordPress plugin < 1.8.17 contains a path traversal caused by improper URL validation in the cache purge routine, letting unauthenticated attackers delete arbitrary files and directories, exploit requires another plugin passing a request-derived URL.
- 9.8 /10 CriticalCVE-2026-15989 PoC publicNo auth
Super Forms – Drag & Drop Form Builder - Privilege Escalation
Super Forms – Drag & Drop Form Builder plugin for WordPress <= 6.3.316 contains a privilege escalation caused by improper validation of the 'role' key in Register & Login add-on's before_email_success_msg() function, letting unauthenticated attackers register as administrators by injecting role=administrator in registration forms, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-15983 Auth required
Super Forms – Drag & Drop Form Builder - Arbitrary File Deletion
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains an arbitrary file/directory deletion vulnerability caused by lack of capability checks and improper sanitization in AJAX handlers, letting authenticated Subscriber-level users delete arbitrary files/directories, exploit requires authenticated Subscriber-level access.
- 7.4 /10 HighCVE-2026-15911 PoC publicNo auth
Confluent Kafka Python client - Information Disclosure
Confluent Kafka Python client contains a sensitive information disclosure caused by improper TLS certificate validation in HashiCorp Vault KMS integration, letting remote attackers obtain sensitive information, exploit requires network access.
- 7.2 /10 HighCVE-2026-14995 No auth
Autoptimize WordPress Plugin - Stored XSS
Autoptimize WordPress plugin <= 3.1.15.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in REQUEST_URI path, letting unauthenticated attackers inject scripts executed by users, exploit requires Critical CSS feature active with valid API key.
- 8.1 /10 HighCVE-2026-14316
Generic - Buffer Overflow
A vulnerability in the revoked-key error path causes a heap buffer overflow due to insufficient buffer size for sprintf() formatted message, letting attackers cause memory corruption, exploit requires triggering the error path.