Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 404 of 695
- 8.1 /10 HighCVE-2026-86683 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182000 contains a broken access control vulnerability caused by allowing low-privileged users to change proxy settings, letting attackers modify configuration, exploit requires low-privileged user access.
- 7.6 /10 HighCVE-2026-86681 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182200 contains a broken access control caused by improper permissions validation, letting low-privileged users execute administrator-configured MBean actions outside their scope, exploit requires low-privileged user access.
- 7.1 /10 HighCVE-2026-86679 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182000 contains a broken access control caused by improper permissions validation, letting low-privileged users delete service monitors outside their scope, exploit requires low-privileged user access.
- 8.8 /10 HighCVE-2026-86678 Auth required
ZohoCorp ManageEngine Applications Manager - Broken Access Control
ZohoCorp ManageEngine Applications Manager <= 182000 contains a broken access control vulnerability caused by low-privileged users obtaining administrator API keys, letting attackers perform administrator-level actions, exploit requires low-privileged user access.
- 8.8 /10 HighCVE-2026-86677 Auth required
ZohoCorp ManageEngine Applications Manager - SQL Injection
ZohoCorp ManageEngine Applications Manager <= 182000 contains a SQL injection caused by insufficient input validation, letting low-privileged users execute unauthorized SQL commands, potentially gaining administrator access and remote code execution, exploit requires low-privileged user access.
- 8.2 /10 HighCVE-2026-86608 No auth
WP Recipe Maker - Broken Access Control
WP Recipe Maker WordPress plugin < 10.8.2 contains a broken access control vulnerability caused by missing authorization checks in a REST route, letting unauthenticated attackers write unlimited data to any user's metadata, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-86583 Auth required
WordPress Import and export users and customers - Privilege Escalation
WordPress Import and export users and customers plugin <= 2.4.17 contains a privilege escalation caused by CSV escape character mismatch in export/import workflow, letting authenticated attackers with Subscriber-level access escalate to Administrator, exploit requires site administrator to trigger export re-import with specific options.
- 9.1 /10 CriticalCVE-2026-86350 PoC publicNo auth
Apache Tomcat - HTTP Request Smuggling
Apache Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121 contain an HTTP request smuggling caused by regression in fix for CVE-2026-41293, letting attackers trigger request header mix-up, exploit requires crafted HTTP/2 requests.
- 9.8 /10 CriticalCVE-2026-86248
Apache Tomcat - Authentication Bypass
Apache Tomcat 11.0.0-M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121 contain an authentication bypass caused by CLIENT_CERT authentication not failing as expected when soft fail is disabled, letting attackers bypass authentication, exploit requires specific CLIENT_CERT soft fail configuration.
- 7.4 /10 HighCVE-2026-86247
Apache Tomcat Native - Authentication Bypass
Apache Tomcat Native 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 contain a race condition caused by thread handling in client certificate verification, letting attackers downgrade verification requirements, exploit requires specific configuration.
- 9.1 /10 CriticalCVE-2026-86246 No auth
Apache Tomcat Native - Insecure Default Configuration
Apache Tomcat Native 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 contain an insecure default configuration caused by enabled insecure options including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX, letting attackers exploit weakened security, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-86243 No auth
Apache Tomcat Native - Denial of Service
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 contain a buffer over-read vulnerability during the TLS handshake, letting malicious users cause a JVM crash and denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-86065 No auth
Klever-Go - Denial of Service
Klever-Go < 1.7.20 contains a denial of service caused by unauthenticated WebSocket clients with unbounded message size and subscription growth in the /subscribe endpoint, letting attackers exhaust memory and crash the node, exploit requires network access.
- 8.6 /10 HighCVE-2026-86064 No auth
Klever-Go - Broken Access Control
Klever-Go < 1.7.20 contains a broken access control vulnerability caused by unauthenticated access to the default-open GET /log WebSocket route, letting remote attackers change global log levels and access operational logs, exploit requires no authentication.
- 9.6 /10 CriticalCVE-2026-85724 PoC publicAuth required
Moquette - Broken Access Control
Moquette < 0.18.1 contains an authorization bypass caused by improper substitution of client ID and username in pattern-based ACL rules, letting attackers with crafted identities gain cross-tenant read/write access or cause DoS, exploit requires crafted client ID or username.