Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 412 of 695
- 9.1 /10 CriticalCVE-2026-94456 No auth
Postiz - Authentication Bypass
Postiz contains a broken authentication caused by use of non-cryptographically secure Math.random() for generating security-sensitive credentials, letting unauthenticated attackers reconstruct PRNG state and compromise OAuth credentials, exploit requires access to OAuth dynamic client registration endpoint.
- 7.1 /10 HighCVE-2026-94455 Auth required
Enterprise Provisioning Service - Broken Access Control
An HTTP endpoint for provisioning enterprise and reseller organisations lacks authentication middleware, allowing attackers with a valid user session token to create high-tier organisations and obtain valid API keys.
- 7.5 /10 HighCVE-2026-94450 No auth
s2n-quic - Denial of Service
s2n-quic <= 1.88.0 contains a denial of service caused by improper validation of Destination Connection ID length in server endpoints configured to send Retry packets, letting unauthenticated remote attackers shut down the server via crafted UDP datagram.
- 8.1 /10 HighCVE-2026-94384 Auth required
Amazon amazon-connect-salesforce-lambda - Broken Access Control
Amazon amazon-connect-salesforce-lambda < 5.26 contains a broken access control caused by missing authorization in Lambda function dispatching caller-supplied parameters to privileged AWS APIs, letting any IAM principal with lambda:InvokeFunction permission escalate privileges, exploit requires lambda:InvokeFunction permission.
- 9.8 /10 CriticalCVE-2026-94127 CISA KEVPoC publicNo auth
F5 BIG-IP - Remote Code Execution
F5 BIG-IP APM with OAuth profile configured on a virtual server contains a remote code execution vulnerability caused by specific malicious traffic, letting unauthenticated attackers execute code remotely, exploit requires crafted malicious traffic.
- 7.6 /10 HighCVE-2026-94117 Auth required
DevItems HashBar – WordPress Notification Bar - SQL Injection
DevItems HashBar – WordPress Notification Bar <= 2.0.3 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 10.0 /10 CriticalCVE-2026-93952 CISA KEVNo auth
VeloCloud Orchestrator - Broken Access Control
VeloCloud Orchestrator (VCO) contains a broken access control vulnerability allowing remote attackers to access privileged internal functionality, potentially compromising confidentiality, integrity, and availability, exploit requires network access.
- 7.3 /10 HighCVE-2026-93928 No auth
Magepeople inc. Taxi Booking Manager for WooCommerce - Authentication Bypass
Magepeople inc. Taxi Booking Manager for WooCommerce < 2.0.8 contains an authentication bypass caused by use of an alternate path or channel, letting attackers bypass authentication, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-93836 CISA KEVNo auth
WPC Product Bundles for WooCommerce - Stored XSS
WPC Product Bundles for WooCommerce <= 8.6.6 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'qty' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access affected pages.
- 7.2 /10 HighCVE-2026-93778 No auth
WP Yelp Review Slider - Stored XSS
WP Yelp Review Slider for WordPress <= 9.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Yelp Review Text, letting unauthenticated attackers inject scripts executed by users, exploit requires use of Download Reviews feature.
- 7.5 /10 HighCVE-2026-93712 No auth
Dancer2 - Path Traversal
Dancer2 2.1.0 before 2.2.0 for Perl contains a path traversal caused by improper handling of relative path segments in the File route handler, letting unauthenticated attackers read arbitrary files outside public_dir, exploit requires enabling File route handler with static_handler set to 0.
- 7.5 /10 HighCVE-2026-93710
Dancer2 - Broken Access Control
Dancer2 2.0.0 before 2.2.0 contains a broken access control vulnerability caused by improper handling of dying hooks in compile_hooks, letting attackers bypass route refusal and execute unintended route code, exploit requires crafted hook behavior.
- 9.8 /10 CriticalCVE-2026-93616 CISA KEVPoC publicNo auth
Check Point Management Server - Unrestricted File Upload
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-93345 No auth
MikroTik RouterOS - Denial of Service
MikroTik RouterOS < 7.25beta4 contains an improper input validation vulnerability in labelled-VPN NLRI iterators of the routing service, letting unauthenticated on-path attackers crash the BGP service by sending malformed MP_REACH_NLRI UPDATE messages with invalid prefix-lengths.
- 9.8 /10 CriticalCVE-2026-93088
SGLang multimodal generation runtime - Remote Code Execution
SGLang multimodal generation runtime contains an unauthenticated arbitrary code execution caused by ZeroMQ ROUTER socket in DiffusionServer passing unvalidated data to pickle.loads(), letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the socket.