Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 403 of 695
- 7.2 /10 HighCVE-2026-90905 No auth
Joomla Easy Store - Cross-Site Request Forgery
Joomla Easy Store extension 1.0.0-3.0.0 contains a cross-site request forgery caused by missing CSRF token verification and access control in site configuration update endpoint, letting attackers modify mail configuration via forged admin requests, exploit requires admin privileges.
- 8.6 /10 HighCVE-2026-90904 Auth required
Joomla Easy Store - Broken Access Control
Joomla Easy Store extension 1.0.0-3.0.0 contains a broken access control vulnerability caused by a hardcoded true return in allowEdit() method in ApiController.php, letting authenticated backend users edit any record, bypassing ACL checks.
- 7.2 /10 HighCVE-2026-90903 No auth
Joomla Extension joomshaper.com Easy Store - Cross-Site Request Forgery
Joomla Extension joomshaper.com Easy Store 1.0.0-3.0.0 contains a cross-site request forgery caused by missing CSRF token verification in multiple administrator AJAX API endpoints, letting attackers trick logged-in administrators into unauthorized state changes, exploit requires administrator login.
- 8.6 /10 HighCVE-2026-90902 Auth required
Joomla Easy Store - SQL Injection
Joomla Easy Store extension 1.0.0-3.0.0 contains an authenticated, privileged SQL injection caused by unsanitized input concatenated into raw SQL IN clauses in coupon bulk update, letting authenticated administrators execute arbitrary SQL, exploit requires administrator privileges.
- 8.6 /10 HighCVE-2026-90901 Auth required
Joomla Easy Store - Information Disclosure
Joomla Easy Store extension 1.0.0-3.0.0 contains an information disclosure caused by unauthenticated access to the checkout.searchGuestUser endpoint, letting unauthenticated attackers retrieve guest shipping details, exploit requires no authentication.
- 8.2 /10 HighCVE-2026-90899 No auth
Joomla Easy Store - Broken Access Control
Joomla Easy Store extension 1.0.0-3.0.0 contains an IDOR vulnerability caused by unauthenticated access to the checkout.searchGuestUser endpoint, letting unauthenticated attackers access guest PII via email enumeration, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-89425 No auth
FasterXML jackson-core - Denial of Service
FasterXML jackson-core >= 2.8.0 contains an out-of-bounds error caused by unbounded token accumulation in UTF8DataInputJsonParser._reportInvalidToken(), letting attackers cause JVM OutOfMemoryError, exploit requires malformed token input via DataInput parser.
- 7.3 /10 HighCVE-2026-88832 Auth required
BusyBox - Buffer Overflow
BusyBox contains a heap buffer overflow caused by unbounded strlen on attacker-controlled romfs volume ID metadata, letting attackers cause memory corruption via crafted filesystem images, exploit requires crafted filesystem image.
- 7.5 /10 HighCVE-2026-88830 No auth
BusyBox - Buffer Overflow
BusyBox contains a heap buffer overflow caused by unit confusion in TLS Montgomery reduction buffer allocation when processing a crafted ClientKeyExchange message, letting remote attackers cause memory corruption, exploit requires crafted message.
- 7.5 /10 HighCVE-2026-87022 No auth
Apache Tomcat - Server Side Request Forgery
Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain a server side request forgery caused by improper handling of length parameter inconsistency in WebSocket per-message-deflate, letting attackers perform WebSocket message smuggling, exploit requires use of per-message-deflate.
- 7.3 /10 HighCVE-2026-86938 Auth required
FileMaker Pro - DLL Hijacking
FileMaker Pro installer for Windows contains a DLL hijacking vulnerability caused by loading malicious DLLs from the installer directory, letting local attackers execute arbitrary code with administrator privileges, exploit requires local access.
- 9.1 /10 CriticalCVE-2026-86934 No auth
FileMaker Server - Authorization Bypass
FileMaker Server before 26.0.3 contains an authorization bypass caused by improper handling of extended privilege headers in the Web Publishing Engine, letting attackers access the XML Web Publishing interface despite disabled settings, exploit requires crafted requests with extended privilege headers.
- 9.1 /10 CriticalCVE-2026-86930 No auth
FileMaker Server - Out of Bounds Read
FileMaker Server for Linux contains an out-of-bounds read vulnerability caused by processing specially crafted image files in container fields during thumbnail generation in FileMaker WebDirect, letting attackers disclose process memory, exploit requires uploading a crafted image file.
- 7.8 /10 HighCVE-2026-86926 No auth
FileMaker Server - Remote Code Execution
FileMaker Server contains a heap buffer overflow caused by improper parsing in the database engine block routine, letting attackers execute arbitrary code via crafted .fmp12 files, exploit requires crafted database file.
- 10.0 /10 CriticalCVE-2026-86708 No auth
ZohoCorp ManageEngine Applications Manager - Authentication Bypass
ZohoCorp ManageEngine Applications Manager <= 182200 contains an exposure of Google Cloud service-account private key in the installer, letting unauthenticated attackers impersonate the service account and access or modify cloud resources, exploit requires no authentication.