Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 442 of 695
- 8.8 /10 HighCVE-2026-93031 Auth required
WP Cloud Plugins - Arbitrary File Upload
WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box for WordPress <= 3.8.3 contain an arbitrary file upload caused by missing capability checks and improper file validation in download_file_to_uploads, letting authenticated attackers with subscriber-level access upload executable files, exploit requires subscriber-level authentication.
- 9.1 /10 CriticalCVE-2026-93019 No auth
Perl Imager - Denial of Service
Perl Imager < 1.036 contains a denial of service caused by improper handling of large TGA colour map length in tga_palette_read, letting attackers cause uncatchable process exit by reading crafted TGA files, exploit requires attacker-supplied file input.
- 7.5 /10 HighCVE-2026-92708 No auth
Svelte devalue - Information Disclosure
Svelte devalue 5.1.0 through 5.9.2 contains an information disclosure caused by serializing the entire backing ArrayBuffer of typed arrays, letting attackers access up to 64 KB of unrelated process memory during server-side rendering, exploit requires a public page returning a small Buffer.
- 9.1 /10 CriticalCVE-2026-92702 No auth
Cocos AI - Authentication Bypass
Cocos AI <= 0.8.2 contains an attestation freshness enforcement bypass caused by missing or empty expected reportData in the intra-handshake attested TLS AMD SEV-SNP verification path, letting attackers supply stale or unrelated evidence, exploit requires omission of expected reportData.
- 9.1 /10 CriticalCVE-2026-92701 PoC publicNo auth
Trusted Execution Environments - Authentication Bypass
Trusted Execution Environments up to 0.8.2 contain a session-misbinding vulnerability caused by missing freshness value copy in Intel TDX quote validation, letting attackers bind sessions to unintended attestation contexts, exploit requires crafted TDX QuoteV4 Evidence.
- 7.2 /10 HighCVE-2026-92619 Auth required
Booking Calendar - Privilege Escalation
Booking Calendar WordPress plugin <= 11.8.2 contains a privilege escalation caused by improper option policy checks in handle_ajax_save() via wpbc_ajax_option_save AJAX action, letting authenticated Editors escalate to Administrator by modifying core options, exploit requires Editor-level access.
- 7.5 /10 HighCVE-2026-91149 No auth
Cockpit - Denial of Service
Cockpit contains a denial of service caused by unbounded thread creation in the cockpit-tls service, letting unauthenticated remote attackers exhaust system resources, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-91127 No auth
File Viewer - Stored XSS
File Viewer @file-viewer/doc < 2.3.1 and msdoc-viewer < 0.2.2 contain a stored XSS caused by unsafe URL schemes in legacy DOC renderer hyperlink targets, letting attackers execute scripts in the embedding application's origin, exploit requires user clicking crafted link.
- 7.1 /10 HighCVE-2026-90978 Auth required
Filter Gallery WordPress plugin - Broken Access Control
Filter Gallery WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by missing nonce verification and capability checks in AJAX handlers, letting low-privileged users overwrite posts and delete stored gallery options, exploit requires low-privileged user access.
- 8.1 /10 HighCVE-2026-89413 Auth required
Filter Gallery WordPress Plugin - Authorization Bypass
Filter Gallery WordPress plugin <= 1.1.4 contains an authorization bypass caused by improper user authorization verification, letting authenticated attackers with subscriber-level access delete arbitrary gallery records, exploit requires omission of nonce POST field.
- 7.5 /10 HighCVE-2026-89059 No auth
RESTEasy - Denial of Service
RESTEasy contains a denial of service caused by lack of limits on declared image dimensions in IIOImageProvider, letting remote unauthenticated attackers exhaust JVM heap via crafted images.
- 7.4 /10 HighCVE-2026-89058 No auth
RESTEasy - CORS Misconfiguration
RESTEasy CorsFilter contains a CORS misconfiguration caused by reflecting the Origin header with Access-Control-Allow-Credentials set to true when allowing all origins, letting attackers perform credentialed cross-origin requests and read authenticated responses, exploit requires permissive CORS configuration.
- 8.8 /10 HighCVE-2026-88825 No auth
iGMS Direct Booking WordPress plugin - Stored XSS
iGMS Direct Booking WordPress plugin < 2.0 contains a stored XSS caused by lack of authorization and escaping in widget appearance settings, letting unauthenticated attackers execute scripts in admin and visitor browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-88623 No auth
NUUO Network Video Recorder - Arbitrary File Read
NUUO Network Video Recorder 2.0.0 contains an arbitrary file read vulnerability caused by improper handling of the url parameter in up.php, letting remote attackers read arbitrary files without authentication.
- 8.8 /10 HighCVE-2026-88622 No auth
NUUO Network Video Recorder - Command Injection
NUUO Network Video Recorder 2.0.0 contains a command injection caused by improper input handling in handle_import_privilege.php, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.