Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 410 of 695

  • 8.1 /10 High
    CVE-2026-18181 No auth

    IBM Financial Transaction Manager - Authentication Bypass

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken authentication caused by a hard-coded cryptographic key, letting remote attackers bypass authentication and access sensitive information, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-18177 No auth

    IBM Financial Transaction Manager (FTM) - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control vulnerability caused by missing authorization checks, letting remote attackers execute unauthorized payment actions, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-15358 No auth

    ZohoCorp ManageEngine OpManager & Network Configuration Manager - Path Traversal

    ZohoCorp ManageEngine OpManager and Network Configuration Manager < 12.8.671 contain an unauthorized path traversal vulnerability caused by improper input validation, letting attackers access arbitrary files, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-15027 No auth

    Changing CGServiSign - OS Command Injection

    Changing CGServiSign contains an OS command injection caused by unsanitized input in the local service interface, letting unauthenticated remote attackers execute arbitrary OS commands by inducing victim interaction.

  • 8.8 /10 High
    CVE-2026-14913 Auth required

    ZohoCorp ManageEngine OpManager & Firewall Analyzer - SQL Injection

    ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.669 contain an SQL injection caused by improper sanitization in Rule Management Search Reports, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted requests.

  • 8.2 /10 High
    CVE-2026-14321 No auth

    divi-dash WordPress Plugin - Broken Access Control

    divi-dash WordPress plugin < 1.0.7 contains a broken access control vulnerability caused by lack of validation of client IP source, letting unauthenticated attackers spoof IPs to bypass rate limiting and cause denial of service, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-12370 Auth required

    ZohoCorp ManageEngine - Server-Side Template Injection

    ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager <= 12.8.667 contain a server-side template injection caused by unsafe Configlet processing, letting remote attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2025-63564 No auth

    Moodle Socialwall - SQL Injection

    Moodle Socialwall plugin v3.0 through v3.3 contains a sql injection caused by improper sanitization of input in HTTP requests, letting attackers execute arbitrary code remotely, exploit requires crafted HTTP requests.

  • 8.6 /10 High
    CVE-2022-4997 No auth

    jet-form-builder-stripe-gateway WordPress - SQL Injection

    jet-form-builder-stripe-gateway WordPress plugin < 1.1.0 contains a SQL injection caused by unsanitised and unescaped payment token in SQL statements, letting unauthenticated attackers extract arbitrary database data including password hashes, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-95862 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an out-of-bounds write vulnerability that allows a network attacker to cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-95861 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an uncontrolled recursion vulnerability caused by improper input handling, letting network attackers cause denial of service, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-95831 No auth

    Crypt::SelfCertificate - Remote Code Execution

    Crypt::SelfCertificate 1.01 through 1.05 for Perl contains a remote code execution vulnerability caused by execution of a Python script from an obfuscated URL in certificate files, letting attackers invoke arbitrary code as the user, exploit requires installation of affected versions.

  • 7.3 /10 High
    CVE-2026-95819 No auth

    anirbandutta9 College-Notes-Gallery - SQL Injection

    anirbandutta9 College-Notes-Gallery contains a SQL injection caused by manipulation of user/pass arguments in login.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.1 /10 High
    CVE-2026-95814 Auth required

    Vaultwarden - Broken Access Control

    Vaultwarden through 1.37.3 contains a broken access control vulnerability caused by omission of organization membership status validation in cipher access queries, letting revoked or pending members retain unauthorized cipher access, exploit requires revoked or pending membership.

  • 9.8 /10 Critical
    CVE-2026-95675 CISA KEVPoC publicNo auth

    D-Link DAP-1360 - Remote Code Execution

    D-Link DAP-1360 <= 6.14 contains an unauthenticated remote code execution caused by crafted requests to the web management interface, letting remote attackers execute arbitrary commands as root, exploit requires no authentication.