Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 405 of 695
- 7.2 /10 HighCVE-2026-85475 Auth required
Ansible Automation Platform - Command Injection
Ansible Automation Platform automation controller contains a command injection caused by unsanitized interpolation of user-controlled logging settings into rsyslog RainerScript config, letting privileged users execute arbitrary commands, exploit requires superuser privileges.
- 7.1 /10 HighCVE-2026-84791 Auth required
ZohoCorp ManageEngine OpManager & Firewall Analyzer - Broken Access Control
ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.710 contain a broken access control vulnerability caused by insufficient scope validation in Change Management report schedule configurations, letting authenticated low-privilege users modify firewall reports outside their assigned scope, exploit requires authenticated low-privilege user.
- 7.1 /10 HighCVE-2026-84789 Auth required
ZohoCorp ManageEngine OpManager & Firewall Analyzer - Broken Access Control
ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.710 contain a broken access control vulnerability caused by insufficient scope validation in alert notification creation, letting authenticated low-privilege users create alerts outside their assigned scope.
- 8.1 /10 HighCVE-2026-84787 Auth required
ZohoCorp ManageEngine OpManager & Firewall Analyzer - Privilege Escalation
ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.710 contain a privilege escalation caused by Report Profile import, letting authenticated low-privilege users gain Administrator privileges, exploit requires authentication.
- 9.9 /10 CriticalCVE-2026-84719 Auth required
Ansible Automation Platform automation-controller - Broken Access Control
Ansible Automation Platform automation-controller contains a broken access control caused by incomplete permission checks when copying WorkflowJobTemplate, letting users with organization workflow-admin permission bypass instance group restrictions and run jobs in unauthorized control-plane context, exploit requires organization workflow-admin permission.
- 7.1 /10 HighCVE-2026-84714 Auth required
Ansible automation-controller - Template Injection
Ansible automation-controller contains a template injection caused by improper input validation in sanitize_jinja(), letting low-privileged users execute arbitrary commands and disclose secrets by injecting Jinja in launch-time fields, exploit requires low-privileged user access.
- 7.6 /10 HighCVE-2026-84706 Auth required
Ansible Automation Platform - Command Injection
Ansible Automation Platform automation-controller contains a command injection caused by insufficient environment-variable validation in custom Credential Type injector, letting privileged users execute arbitrary code inside execution-environment containers, exploit requires privileged user access.
- 8.7 /10 HighCVE-2026-84691 Auth required
Red Hat Ansible Automation Platform - Authentication Bypass
Red Hat Ansible Automation Platform automation-controller contains a format string vulnerability caused by administrator-controlled Python format-string templates in API 4XX error logs, letting authenticated administrators read sensitive secrets and exfiltrate them via log forwarding, exploit requires administrator privileges.
- 8.7 /10 HighCVE-2026-84683 Auth required
Red Hat Ansible Automation Platform - Stored XSS
Red Hat Ansible Automation Platform automation-controller contains a stored XSS caused by unfiltered ANSI OSC 8 hyperlink sequences in HTML output, letting low-privileged users embed javascript links that execute code when viewed by higher-privileged users, exploit requires output generation by low-privileged user or external data.
- 9.9 /10 CriticalCVE-2026-84502 Auth required
Red Hat Ansible Automation Platform - Command Injection
Red Hat Ansible Automation Platform automation-controller contains a command injection caused by improper validation of the Project scm_url field, letting users with project modification permissions execute arbitrary commands on the control-plane task pod, exploit requires user with project create or modify permissions.
- 7.7 /10 HighCVE-2026-84499 Auth required
Red Hat Ansible Automation Platform - Broken Access Control
Red Hat Ansible Automation Platform automation-controller contains an information disclosure vulnerability caused by plaintext password exposure in validation error messages during survey revalidation, letting delegated JobTemplate Admin users recover other users' stored passwords.
- 8.2 /10 HighCVE-2026-84486 No auth
Red Hat Ansible Automation Platform - Denial of Service
Red Hat Ansible Automation Platform automation-controller contains a denial of service caused by unauthenticated access to debug views triggering cluster-wide scheduler lock, letting unauthenticated remote attackers stall job dispatch and consume resources.
- 9.9 /10 CriticalCVE-2026-84474 Auth required
Red Hat Ansible Automation Platform - Privilege Escalation & Remote Code Execution
Red Hat Ansible Automation Platform automation-controller contains a privilege escalation and remote code execution vulnerability caused by exposure of provisioning-callback secret and trusting client-supplied X-Forwarded-For header, letting minimally privileged or unauthenticated attackers execute jobs on arbitrary managed hosts, exploit requires empty proxy allow-list and read-level view_jobtemplate permission.
- 9.0 /10 CriticalCVE-2026-82843 Auth required
WP OAuth Server (Login with WordPress) - Authentication Bypass
WP OAuth Server (Login with WordPress) < 6.4.0 contains an authentication bypass caused by improper binding of OpenID Connect identity assertions to authorization grants, letting users with Subscriber role or higher authenticate as other users including administrators, exploit requires user to have Subscriber role or above.
- 7.5 /10 HighCVE-2026-82356
Imprivata EAM - Cryptographic Misconfiguration
Imprivata EAM <=26.2.6 contains a cryptographic misconfiguration caused by the inability to rotate RSA key pairs after deployment when generating X.509 certificates, letting attackers exploit weak key management, exploit requires indefinite use of the same RSA key pair.