Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 41 of 891

  • 8.3 /10 High
    CVE-2026-45049 No auth

    Open Access Management (OpenAM) - Authentication Bypass

    Open Access Management (OpenAM) < 16.1.1 contains a session hijacking vulnerability caused by the Cross-Domain Single Sign-On (CDSSO) servlet allowing raw session tokens to be POSTed to attacker-controlled URLs, letting attackers hijack sessions via authenticated victims visiting crafted URLs, exploit requires CDSSO enabled and non-default configuration absent.

  • 9.8 /10 Critical
    CVE-2026-42922 No auth

    FUXA - Authorization Bypass

    FUXA 1.3.2-2809 contains an authorization bypass caused by improper access control in /nodered functionality, letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted HTTP request.

  • 7.2 /10 High
    CVE-2026-42701 Auth required

    Shop manager YayMail - PHP Object Injection

    Shop manager YayMail <= 4.4.6 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-42692 No auth

    WP Crowdfunding - Reflected XSS

    WP Crowdfunding <= 2.2.2 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts in users' browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-42057 No auth

    vtk - Null Pointer Dereference

    vtk 9.6 contains a null pointer dereference caused by improper handling of specially crafted PNG files in vtkPNGReader::vtkPNGReaderUpdate2, letting attackers cause denial of service, exploit requires malicious file input.

  • 7.5 /10 High
    CVE-2026-41216 No auth

    vtk - Denial of Service

    vtk 9.6 contains a null pointer dereference caused by improper handling of specially crafted .png files in vtkPNGReader::ExecuteInformation, letting attackers cause denial of service, exploit requires malicious file input.

  • 8.5 /10 High
    CVE-2026-39736 Auth required

    Crocoblock JetEngine - SQL Injection

    Crocoblock JetEngine <= 3.9.0.1 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-33924 Auth required

    Unknown Vendor Unknown Product - Command Injection

    An unspecified vendor product contains an OS command injection caused by insufficient validation of update bundle contents in the update installation functionality, letting attackers with administrative privileges execute arbitrary commands remotely with root privileges.

  • 7.2 /10 High
    CVE-2026-33923 Auth required

    Unknown Vendor Unknown Product - Authentication Bypass

    An unspecified vendor's product contains a signature verification vulnerability caused by inconsistent validation of update bundle contents, letting attackers with administrative privileges run unsigned scripts with root privileges remotely, exploit requires admin privileges.

  • 7.1 /10 High
    CVE-2026-27394 No auth

    Eventer - Reflected XSS

    Eventer <= 0.1.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 8.3 /10 High
    CVE-2026-21157 Auth required

    Bixby - Improper Input Validation

    Bixby < 4.0.85.6 contains an improper input validation vulnerability allowing privileged local attackers to launch arbitrary activity, exploit requires local privileged access.

  • 8.7 /10 High
    CVE-2026-13303 Auth required

    HashiCorp Boundary - Server-Side Request Forgery

    HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery caused by improper validation in the Vault credential store integration, letting authenticated users with credential management permissions make arbitrary outbound requests, exploit requires authenticated user with specific permissions.

  • 7.5 /10 High
    CVE-2026-119325 No auth

    Bricks Theme - Broken Access Control

    Bricks Theme for WordPress <= 2.4 contains a broken access control vulnerability in the load_popup_content REST endpoint, letting anonymous attackers read draft and unpublished page content by manipulating popupId without status or capability checks.

  • 7.5 /10 High
    CVE-2026-119286 No auth

    GraphQL-core - Denial of Service

    GraphQL-core 3.3.0a3 to 3.3.1 contains a denial of service caused by reuse of ValidationAbortedError retaining tracebacks, letting unauthenticated clients exhaust memory by submitting documents with many validation errors, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-119283 No auth

    joserfc - Denial of Service

    joserfc < 1.7.5 contains a denial of service caused by unbounded processing of JWE recipients array in jwe.decrypt_json(), letting unauthenticated attackers exhaust CPU by submitting crafted JWE, exploit requires attacker to submit JWE with multiple recipients.