Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 386 of 767
- 9.8 /10 CriticalCVE-2026-82307 No auth
Dolusoft Software Technologies SOPLOG - SQL Injection
Dolusoft Software Technologies SOPLOG < 2026.9.4.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-79625 Auth required
Affected products - Race Condition
Affected products contain a race condition caused by improper synchronization in monitoring functionality, letting authenticated remote attackers cause incorrect data processing or denial of service, exploit requires monitoring access.
- 9.1 /10 CriticalCVE-2026-77185
Apache MINA SSHD - Authentication Bypass
Apache MINA SSHD 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 contain an authentication bypass caused by flawed asynchronous authentication logic in sshd-core, letting attackers skip signature checks in public-key or hostbased authentication, exploit requires server to use asynchronous authentication with these schemes.
- 7.5 /10 HighCVE-2026-76992
CODESYS Gateway Client - Denial of Service
CODESYS Gateway Client contains a denial of service caused by unchecked memory allocation based on size field in gateway response, letting unauthenticated remote attackers cause excessive memory consumption, exploit requires attacker to control a malicious gateway.
- 9.1 /10 CriticalCVE-2026-76570 PoC publicNo auth
Joomla Extension joomcode.com JCTables - SQL Injection
Joomla Extension joomcode.com JCTables 1.21.1 contains an unauthenticated SQL injection caused by lack of token validation and authentication in front-end CRUD API controller, letting attackers execute arbitrary read and write SQL queries remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-76504 CISA KEVPoC publicNo auth
Cisco Catalyst SD-WAN Manager - Authentication Bypass
Cisco Catalyst SD-WAN Manager contains an authentication bypass caused by improper URI encoding handling in HTTP requests, letting unauthenticated remote attackers gain admin privileges, exploit requires crafted HTTP request.
- 9.8 /10 CriticalCVE-2026-75873 No auth
Zella Theme WordPress - Unrestricted File Upload
Zella Theme WordPress theme < 2.6.3 contains an unrestricted file upload vulnerability caused by lack of capability and nonce checks in font upload action, letting unauthenticated attackers upload arbitrary files including PHP for remote code execution.
- 7.4 /10 HighCVE-2026-75823
User Frontend WordPress plugin - Broken Access Control
User Frontend WordPress plugin < 4.3.12 contains a broken access control vulnerability caused by insufficient validation of role assignment in the registration form, letting unauthenticated users register with elevated roles like Editor, exploit requires PHP sodium extension to be unavailable and a configured registration page.
- 7.5 /10 HighCVE-2026-75098 No auth
WordPress Product Designer App - Path Traversal
Product Designer App plugin for WordPress <= 1.1.3 contains a directory traversal caused by improper validation of the 'svg' parameter, letting unauthenticated attackers read arbitrary files, exploit requires publicly exposed nonce and token.
- 7.5 /10 HighCVE-2026-6806 No auth
The Motors – Car Dealership & Classified Listings Plugin - SQL Injection
The Motors – Car Dealership & Classified Listings Plugin for WordPress <= 1.4.109 contains a time-based blind SQL injection caused by insufficient escaping of 'stm_lat/stm_lng' parameters, letting unauthenticated attackers extract sensitive database information, exploit requires crafted parameter input.
- 9.1 /10 CriticalCVE-2026-62308 Auth required
Tugtainer - Server-Side Request Forgery
Tugtainer < 1.30.6 contains a server-side request forgery caused by unrestricted URL input in /settings/test_notification endpoint, letting authenticated users make backend send arbitrary HTTP requests, exploit requires authentication.
- 7.8 /10 HighCVE-2026-62146 PoC public
CRI-O - Broken Access Control
CRI-O contains a trust-boundary flaw in sandbox state persistence caused by attacker-influenced pod metadata overwriting reserved sandbox bookkeeping, letting attackers escape container via host runtime resource exposure after restart, exploit requires attacker to influence pod metadata.
- 7.6 /10 HighCVE-2026-62097 Auth required
WPTasty Business Directory - SQL Injection
WPTasty Business Directory business-directory-plugin <= 6.4.27 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 7.6 /10 HighCVE-2026-62085 Auth required
WP Activity Log - SQL Injection
WP Activity Log <= 5.6.6 contains a SQL injection caused by improper sanitization of input, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-55494 PoC publicNo auth
Tugtainer Agent - Authentication Bypass
Tugtainer Agent < 1.30.4 contains an authentication bypass caused by empty AGENT_SECRET allowing signature verification to succeed, letting unauthenticated attackers access Docker management APIs, exploit requires AGENT_SECRET to be unset.