Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 385 of 767

  • 7.5 /10 High
    CVE-2026-89193 No auth

    Robin Image Optimizer - Stored XSS

    Robin Image Optimizer WordPress plugin < 2.0.8 contains a stored XSS caused by unescaped values in HTML parser element attributes when non-default image delivery mode is enabled, letting unauthenticated attackers execute scripts in users' browsers.

  • 9.8 /10 Critical
    CVE-2026-88920 No auth

    Apache WSS4J - Authentication Bypass

    Apache WSS4J < 4.0.2, < 3.0.6, and < 2.4.4 contain an authentication bypass caused by crafted unsigned SAML sender-vouches assertion with attacker-controlled key in DOM security processor, letting unauthenticated remote attackers forge authenticated SOAP messages.

  • 7.1 /10 High
    CVE-2026-88797 Auth required

    Vayu X WordPress theme - Broken Access Control

    Vayu X WordPress theme < 1.0.6 contains a broken access control vulnerability caused by missing capability checks on an AJAX action, letting authenticated users install and activate plugins, exploit requires user to be logged in.

  • 9.1 /10 Critical
    CVE-2026-87830 No auth

    StAX WS-SecurityPolicy Validator - Broken Access Control

    StAX streaming WS-SecurityPolicy validator contains a broken access control vulnerability caused by incorrect handling of relative or unsupported XPath expressions, letting remote SOAP peers bypass signature or encryption requirements, exploit requires sending crafted SOAP messages.

  • 8.1 /10 High
    CVE-2026-87004 PoC publicNo auth

    Tugtainer - Authentication Bypass

    Tugtainer < 1.31.3 contains an authentication bypass caused by improper OIDC id_token validation in auth_oidc_provider.py, letting attackers bypass token verification and impersonate users, exploit requires valid OIDC login flow completion.

  • 8.1 /10 High
    CVE-2026-86136 Auth required

    wgagent - Broken Access Control

    wgagent management daemon contains a missing authorization vulnerability in session initialization, letting authenticated low-privileged users crash the process and read arbitrary files via crafted management API requests.

  • 7.5 /10 High
    CVE-2026-86134 No auth

    WatchGuard Fireware OS - Denial of Service

    WatchGuard Fireware OS contains a null pointer dereference caused by improper handling in the authentication process, letting remote unauthenticated attackers crash the management daemon, exploit requires sending a specially crafted request to the login interface.

  • 7.5 /10 High
    CVE-2026-86133 No auth

    WatchGuard Fireware OS - Denial of Service

    WatchGuard Fireware OS IKE daemon contains an integer underflow vulnerability caused by processing specially crafted encrypted IKEv2 messages, letting remote attackers crash the iked process after completing initial IKEv2 handshake, exploit requires completed initial handshake.

  • 7.5 /10 High
    CVE-2026-86132 No auth

    WatchGuard Fireware OS - Denial of Service

    WatchGuard Fireware OS contains an integer underflow vulnerability in the IKEv2 daemon (iked) caused by processing specially crafted encrypted IKEv2 messages with AES-GCM cipher suite, letting remote unauthenticated attackers crash the process.

  • 9.8 /10 Critical
    CVE-2026-86131

    WatchGuard Fireware OS - Command Injection

    WatchGuard Fireware OS contains a command injection caused by improper handling of BOVPN Over TLS client configuration, letting attackers controlling the remote VPN server execute arbitrary commands as root, exploit requires attacker to control remote VPN server.

  • 7.5 /10 High
    CVE-2026-86128 No auth

    Fireware OS - Denial of Service

    Fireware OS contains a null pointer dereference vulnerability in the NetFlow packet-processing feature, letting remote unauthenticated attackers cause denial of service by sending specially crafted IPv6 packets.

  • 7.1 /10 High
    CVE-2026-86105 Auth required

    Fireware OS Access Portal - Broken Access Control

    Fireware OS Access Portal contains an improper authorization vulnerability caused by insufficient access control in the reverse proxy, letting authenticated low-privileged users access unauthorized web applications, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-86104 No auth

    Fireware OS - Denial of Service

    Fireware OS contains a denial of service vulnerability caused by uncontrolled resource consumption in the login process (wgagent), letting remote unauthenticated attackers cause service disruption, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-85573 No auth

    All in One Files Upload WordPress plugin - Stored XSS

    All in One Files Upload WordPress plugin < 2.0.17 contains a stored XSS caused by unsanitized SVG file uploads and lack of upload request verification, letting unauthenticated attackers store active content executed in site's origin, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-85532 No auth

    Apache WSS4J - Weak Cryptography & Denial of Service

    Apache WSS4J contains a cryptographic weakness caused by accepting attacker-controlled derived-key lengths and offsets without adequate bounds, letting attackers cause weak keys or resource exhaustion, exploit requires crafted WS-Security messages.