Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 426 of 695
- 7.2 /10 HighCVE-2026-12470 Auth required
NiteoThemes CMP – Coming Soon & Maintenance Plugin - Broken Access Control
NiteoThemes CMP – Coming Soon & Maintenance Plugin for WordPress <= 4.1.17 contains a broken access control vulnerability caused by missing capability check on 'cmp_ajax_import_settings' AJAX action, letting authenticated attackers with Editor-level access escalate privileges by modifying arbitrary options.
- 8.8 /10 HighCVE-2025-1281 Auth required
BM Content Builder WordPress plugin - Arbitrary File Deletion
BM Content Builder WordPress plugin < 3.17.1 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions, letting authenticated attackers with Subscriber-level access delete arbitrary files on the server, exploit requires authenticated Subscriber-level access or higher.
- 9.8 /10 CriticalCVE-2016-15059 No auth
Net::IDN::Punycode - Buffer Overflow
Net::IDN::Punycode < 2.301 for Perl contains a heap buffer overflow caused by unchecked writes past the output buffer in encode_punycode XS backend, letting attackers corrupt heap memory remotely, exploit requires crafted input string.
- 7.5 /10 HighCVE-2026-94627 No auth
vLLM Mooncake connector - Denial of Service
vLLM Mooncake connector through 0.29.0 contains a denial of service caused by improper GPU KV cache block ownership management in concurrent child requests, letting attackers exhaust GPU memory, exploit requires concurrent child requests sharing a transfer ID.
- 7.5 /10 HighCVE-2026-94626
vLLM - Denial of Service
vLLM through 0.29.0 contains an unbounded memory allocation vulnerability caused by failure to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, letting attackers exhaust memory and trigger kernel OOM-kill, exploit requires attacker to supply arbitrary tp_size values in prefill/decode disaggregated deployments.
- 7.5 /10 HighCVE-2026-94624 No auth
vLLM - Denial of Service
vLLM through 0.29.0 contains a denial of service vulnerability caused by unreachable peer sessions in P2P KV offloading with OffloadingConnector configured with TieringOffloadingSpec and a peer-to-peer secondary tier, letting attackers crash EngineCore and stop all inference, exploit requires supplying arbitrary remote host and port values.
- 7.5 /10 HighCVE-2026-94623 No auth
vLLM - Denial of Service
vLLM through 0.29.0 contains a denial of service vulnerability caused by improper validation of block counts in the NIXL connector's prefix caching during multi-prompt completion requests, letting attackers cause worker termination, exploit requires crafted multi-prompt requests.
- 7.5 /10 HighCVE-2026-94622 No auth
vLLM - Denial of Service
vLLM <= 0.29.0 contains a denial of service vulnerability caused by uncaught KeyError in EngineCore scheduling due to incomplete kv_transfer_params in NIXL connector metadata handling, letting attackers cause decode engine termination, exploit requires crafted requests with incomplete parameters.
- 7.7 /10 HighCVE-2026-94540 No auth
DesktopSMS - Broken Access Control
DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability caused by lack of pairing confirmation in the local service, letting local attackers transmit SMS, retrieve SMS content, and persist paired identity without user interaction.
- 7.1 /10 HighCVE-2026-94535 Auth required
lamp-cloud - Authorization Bypass
lamp-cloud <= 5.10.0 contains an authorization bypass caused by lack of recipient validation in the deleteMyNotice endpoint, letting authenticated users delete other users' notifications.
- 7.1 /10 HighCVE-2026-94534 Auth required
lamp-cloud - Broken Access Control
lamp-cloud <= 5.10.0 contains a broken access control caused by failure to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, letting authenticated attackers modify arbitrary user profiles by supplying target user IDs.
- 8.8 /10 HighCVE-2026-94501 Auth required
jshERP - Authorization Bypass
jshERP through 3.6 contains an authorization bypass caused by missing privilege checks in userBusiness CRUD endpoints, letting authenticated users manipulate user-role mappings and escalate privileges.
- 8.3 /10 HighCVE-2026-94497 Auth required
jshERP - Broken Access Control
jshERP through 3.6 contains a broken access control vulnerability caused by failure to validate object ownership in by-id info, update, and delete endpoints, letting authenticated users read, modify, and delete other users' business objects, exploit requires authentication.
- 8.3 /10 HighCVE-2026-94496 Auth required
jshERP - Broken Access Control
jshERP <= 3.6 contains a broken access control vulnerability caused by failure to validate caller permissions in role management endpoints, letting authenticated users escalate privileges and modify roles, exploit requires authentication.
- 7.1 /10 HighCVE-2026-94495 Auth required
jshERP - Broken Access Control
jshERP <= 3.6 contains a broken access control vulnerability caused by improper validation of user privileges in SystemConfigService.updateSystemConfig, letting authenticated users modify tenant system configuration through the systemConfig endpoint.