Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 397 of 767

  • 7.3 /10 High
    CVE-2026-102909 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "access_code" argument in /reviewer_0/admins/assessments/examproper/btn_functions.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-102908 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "ID" argument in /reviewer_0/admins/assessments/examproper/questions-view.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-102874 No auth

    HKUDS AnyTool - Command Injection

    HKUDS AnyTool 0.1.0 contains a command injection caused by manipulation of the command/shell argument in subprocess.run in Execute Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires remote access.

  • 9.1 /10 Critical
    CVE-2026-102794 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "url" argument in /api/ZRnetwork/ping, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-102793 Auth required

    Ziroom ZHOME - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the hostname/zonename argument in /api/ZRFirmware/set_time_zone, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-102717 No auth

    MQTT WebSocket - Information Disclosure & Denial of Service

    MQTT WebSocket contains a memory disclosure or crash vulnerability caused by setter ABI mismatch, letting attackers cause denial of service or information disclosure, exploit requires crafted WebSocket messages.

  • 7.8 /10 High
    CVE-2026-102490 CISA KEVAuth required

    Zammad - Privilege Escalation

    Zammad all versions contain a privilege escalation vulnerability that allows the local zammad user to escalate privileges to root, exploit requires local access as zammad user.

  • 9.8 /10 Critical
    CVE-2026-102489 CISA KEVPoC publicNo auth

    Zammad - Session Hijacking & Remote Code Execution

    Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.

  • 9.8 /10 Critical
    CVE-2026-102458 No auth

    Digiwin EasyFlow .NET - Authentication Bypass

    Digiwin EasyFlow .NET contains a missing authentication vulnerability caused by an unauthenticated API, letting remote attackers obtain other users' plaintext passwords, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-102455 No auth

    Digiwin EasyFlow .NET - Remote Code Execution

    Digiwin EasyFlow .NET contains an insecure deserialization vulnerability caused by processing maliciously crafted serialized content, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-102454 Auth required

    Digiwin EasyFlow .NET - Arbitrary File Upload

    Digiwin EasyFlow .NET contains an arbitrary file upload vulnerability allowing privileged remote attackers to upload and execute web shell backdoors, enabling arbitrary code execution on the server, exploit requires privileged remote access.

  • 10.0 /10 Critical
    CVE-2026-102427 PoC publicNo auth

    OrdaSoft Joomla CCK - Remote Code Execution

    OrdaSoft Joomla CCK < 8.3.16 contains an unauthenticated remote code execution caused by lack of authentication and improper file extension validation in site/uploader.php, letting attackers upload and execute PHP code remotely, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-102398 No auth

    Supsystic Popup - Reflected XSS

    Supsystic Popup <= 1.13.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-102396 No auth

    Ultimate Maps by Supsystic - Reflected XSS

    Ultimate Maps by Supsystic <= 1.5.5 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-102395 No auth

    Easy Google Maps - Reflected XSS

    Easy Google Maps <= 1.14.6 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.