Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 443 of 695

  • 7.5 /10 High
    CVE-2026-88259

    CareCam CM2507 - Authentication Bypass

    CareCam CM2507 IP cameras contain an authentication bypass caused by lack of authentication on the network video streaming service, letting unauthenticated attackers with network access retrieve live video streams, exploit requires network access to the device.

  • 8.1 /10 High
    CVE-2026-88097 No auth

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows unauthorized local attackers to elevate privileges by exploiting memory management flaws.

  • 7.2 /10 High
    CVE-2026-87915 PoC publicNo auth

    Popup Maker - Stored Cross-Site Scripting

    Popup Maker WordPress plugin <= 1.24.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in values[Name] parameter, letting unauthenticated attackers inject scripts executed on user page access.

  • 8.6 /10 High
    CVE-2026-87775 No auth

    Tz Weekly Radio Schedule WordPress plugin - SQL Injection

    Tz Weekly Radio Schedule WordPress plugin through 1.8.1 contains a SQL injection caused by unsanitized and unescaped parameter in an AJAX action, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87774 No auth

    Tz Weekly Radio Schedule WordPress plugin - SQL Injection

    Tz Weekly Radio Schedule WordPress plugin <= 1.8.1 contains a SQL injection caused by unsanitized and unescaped parameter in an AJAX action, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87771 No auth

    Question and Answer WordPress plugin - SQL Injection

    Question and Answer WordPress plugin through 1.1.0 contains a sql injection caused by unsanitized and unescaped parameters in AJAX actions, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87770 No auth

    Price Drop Alert for Woo Commerce WordPress plugin - SQL Injection

    Price Drop Alert for Woo Commerce WordPress plugin <= 1.1 contains a SQL injection caused by unsanitized and unescaped parameters in an AJAX action, letting unauthenticated attackers extract sensitive data from the database, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-87767 No auth

    wp shortcut link and advertisement baner WordPress plugin - SQL Injection

    wp shortcut link and advertisement baner WordPress plugin <= 1.2.0 contains a SQL injection caused by unsanitized and unescaped parameter in an AJAX action, letting unauthenticated attackers extract sensitive data from the database.

  • 7.5 /10 High
    CVE-2026-87743 No auth

    Quarkus HTTP - Authorization Bypass

    Quarkus HTTP security contains an authorization bypass caused by path normalization discrepancy between security matcher and HTTP request dispatchers, letting unauthenticated attackers access protected endpoints, exploit requires crafted URL.

  • 7.5 /10 High
    CVE-2026-86520

    Bransys ELD - Hardcoded Credentials

    Bransys ELD contains hardcoded MQTT credentials, letting attackers read real-time data from active devices connected to the affected MQTT broker, exploit requires access to the MQTT broker.

  • 7.7 /10 High
    CVE-2026-85887 Auth required

    Microsoft 365 Copilot - Information Disclosure

    Microsoft 365 Copilot contains an information disclosure vulnerability caused by incorrect permission assignment for a critical resource, letting authorized attackers disclose information over a network, exploit requires attacker authorization.

  • 9.9 /10 Critical
    CVE-2026-85878 Auth required

    Azure Database for PostgreSQL - Broken Access Control

    Azure Database for PostgreSQL contains a broken access control vulnerability caused by improper authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 7.5 /10 High
    CVE-2026-85705 No auth

    Location Manager WordPress plugin - SQL Injection

    Location Manager WordPress plugin <= 2.3.38 contains a SQL injection caused by insufficient escaping of 'latitude' and 'longitude' REST API parameters, letting unauthenticated attackers extract sensitive database information, exploit requires orderby=lat_lon parameter.

  • 9.8 /10 Critical
    CVE-2026-85497

    CareCam CM2507 - Authentication Bypass

    CareCam CM2507 IP cameras contain a broken authentication caused by storing root-account password using a fixed legacy password hash, letting attackers recover credentials offline, exploit requires access to firmware or password database.

  • 8.1 /10 High
    CVE-2026-85410 Auth required

    Master Addons for Elementor - Authorization Bypass

    Master Addons for Elementor WordPress plugin <= 3.2.2 contains an authorization bypass caused by improper user authorization verification in popup management, letting authenticated contributors modify or delete arbitrary posts, exploit requires contributor-level access.