Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 411 of 695

  • 7.3 /10 High
    CVE-2026-95656 No auth

    dgtlmoon changedetection.io - Server-Side Request Forgery

    dgtlmoon changedetection.io <= 50389b07 contains a server-side request forgery caused by manipulation of the "url" argument in add_watch_ui_snapshot of Preview Endpoint, letting remote attackers make arbitrary requests, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-95655 Auth required

    Aureus ERP - Broken Access Control

    Aureus ERP < 1.5.0 contains a broken access control caused by failure to scope message lookups in ChatterPanel, letting authenticated users read, edit, delete, or pin arbitrary messages across departments or companies, exploit requires user authentication.

  • 7.4 /10 High
    CVE-2026-95654

    Databasement - Broken Access Control

    Databasement < 1.7.14 contains a broken access control vulnerability caused by caching authorization decisions without re-checking invitation token validity, letting attackers with leaked invitation links overwrite account passwords and gain access, exploit requires leaked or forwarded invitation link.

  • 7.5 /10 High
    CVE-2026-95653 No auth

    Concrete CMS Community Store - Broken Access Control

    Concrete CMS Community Store < 2.7.8 contains an information disclosure caused by predictable digital product download tokens derived from order creation timestamps, letting unauthenticated attackers retrieve digital goods of other customers, exploit requires no authentication.

  • 7.7 /10 High
    CVE-2026-95619 No auth

    libstdc++ - Integer Overflow

    libstdc++ contains an integer overflow caused by processing large inputs to the C++ new operator, letting attackers cause memory corruption or application instability, exploit requires crafted input.

  • 7.4 /10 High
    CVE-2026-95508

    libslirp - Buffer Overflow

    libslirp contains a heap-based buffer overflow caused by improper handling of DHCPv6 CLIENTID or TFTP blksize options with small interface MTU, letting attackers cause denial of service or remote code execution, exploit requires small MTU configuration.

  • 7.3 /10 High
    CVE-2026-95500 No auth

    JosephChuks php-file-manager-with-code-editor - Unrestricted File Upload

    JosephChuks php-file-manager-with-code-editor <= 3.0 contains an unrestricted file upload vulnerability caused by manipulation of filename/content arguments in file_put_contents of codeEditor.php Save Handler, letting remote attackers upload arbitrary files, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-95499 No auth

    JosephChuks php-file-manager-with-code-editor - Unrestricted File Upload

    JosephChuks php-file-manager-with-code-editor <= 3.0 contains an unrestricted file upload vulnerability caused by improper validation in move_uploaded_file function in filemanager.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-95271 No auth

    dgtlmoon changedetection.io - Authentication Bypass

    dgtlmoon changedetection.io <= 0.60.7 contains an authentication bypass caused by improper handling in check_authentication function in Authentication Hook, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-94640 No auth

    rpcbind - Denial of Service

    rpcbind contains a denial of service vulnerability caused by unbounded in-memory list growth from unique RPC requests, letting remote unauthenticated attackers exhaust service availability, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-94574 No auth

    GNU wget - Code Execution

    GNU wget Windows builds from eternallybored.org contain a local code execution vulnerability caused by a hardcoded writable configuration file path C:\msys64, letting unprivileged users execute arbitrary code locally, exploit requires local access.

  • 7.2 /10 High
    CVE-2026-94504 CISA KEVPoC publicNo auth

    Ninja Forms - Stored XSS

    Ninja Forms 3.15.3 contains a stored XSS caused by unsafe rendering of anonymous non-RTE textarea values in the legacy submission editor, letting attackers execute scripts in the WordPress admin origin, exploit requires administrator to open a crafted submission URL.

  • 10.0 /10 Critical
    CVE-2026-94493 No auth

    Gigatech PDV5701 - Authentication Bypass

    Gigatech PDV5701 1.0.31_240305_112640 contains an authentication bypass caused by manipulation in WebSocket Service component /index.html, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-94491 No auth

    Yonyou KSOA - SQL Injection

    Yonyou KSOA 9.0 contains a sql injection caused by manipulation of the "address" argument in /cardcase/search_list.jsp, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-94462 Auth required

    Spree - Broken Access Control

    Spree 5.4.0 to 5.4.4 and 5.5.4 contain an information disclosure caused by lack of cart token verification in cart association, letting authenticated customers access guest cart address data, exploit requires guest cart with address data and no login required for checkout.