Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 444 of 695

  • 8.8 /10 High
    CVE-2026-85127 No auth

    VikBooking Hotel Booking Engine & PMS - Stored XSS

    VikBooking Hotel Booking Engine & PMS WordPress plugin < 1.8.15 contains a stored XSS caused by unrestricted file types and unsanitized contents in live chat attachments, letting unauthenticated visitors execute active content in admin context, exploit requires admin to view the conversation.

  • 8.8 /10 High
    CVE-2026-85122 No auth

    WhiteStudio Easy Form Builder - Stored XSS

    WhiteStudio Easy Form Builder WordPress plugin < 4.2.0 contains a stored XSS caused by lack of validation of submitted values against stored configuration in some form types, letting unauthenticated attackers store and render arbitrary content unescaped in admin page.

  • 7.5 /10 High
    CVE-2026-85058 No auth

    Moquette - Broken Access Control

    Moquette < 0.18.1 contains a broken access control vulnerability caused by missing authorization checks in Last Will message publishing, letting remote clients inject messages into ACL-protected topics, exploit requires anonymous access enabled.

  • 7.4 /10 High
    CVE-2026-84975

    PJSIP - Authentication Bypass

    PJSIP <= 2.17 contains a server impersonation vulnerability caused by improper handling of DNS SubjectAltName with embedded NUL bytes in OpenSSL and GnuTLS backends, letting attackers with a trusted certificate and interception capability impersonate servers, exploit requires attacker to intercept connection and possess a trusted certificate.

  • 9.1 /10 Critical
    CVE-2026-84738 Auth required

    AF Companion WordPress plugin - Unrestricted File Upload

    AF Companion WordPress plugin < 2.2.0 contains an unrestricted file upload vulnerability caused by lack of file type validation in import feature, letting low-privileged store-management users execute remote code.

  • 7.5 /10 High
    CVE-2026-84447 No auth

    libheif - Denial of Service

    libheif <= 1.23.1 contains a denial of service caused by crafted grid, iovl, and iden reference graphs leading to repeated decoding of the same base image, letting attackers cause resource exhaustion, exploit requires crafted input files.

  • 7.5 /10 High
    CVE-2026-84446 No auth

    libheif - Denial of Service

    libheif < 1.23.2 contains a denial of service caused by integer overflow in sample timing calculations, letting attackers cause non-terminating decode loops and severe CPU/memory exhaustion, exploit requires crafted HEIF files.

  • 7.4 /10 High
    CVE-2026-84444 No auth

    libheif - Buffer Overflow

    libheif < 1.23.2 with WITH_UNCOMPRESSED_CODEC enabled contains a heap buffer overflow caused by missing component size checks in heif_context_add_image_tile, letting attackers cause memory corruption, exploit requires crafted HEIF/AVIF files.

  • 7.5 /10 High
    CVE-2026-84398 No auth

    CM2507 IP cameras - Authentication Bypass

    CM2507 IP cameras contain a broken authentication caused by accepting an empty password for a privileged account via ONVIF management service, letting attackers with network access obtain privileged management functions and sensitive configuration information, exploit requires network access to the device.

  • 7.5 /10 High
    CVE-2026-84384 No auth

    libheif - Denial of Service

    libheif 1.19.0 to < 1.23.2 contains a denial of service caused by unbounded memory growth in decompress_brotli() and do_inflate() when processing crafted HEIF or AVIF metadata, letting attackers cause process termination, exploit requires crafted file input.

  • 9.8 /10 Critical
    CVE-2026-84383 PoC publicNo auth

    libheif - Heap Out-of-Bounds Write

    libheif 1.22.0 to < 1.23.2 contains a heap out-of-bounds write caused by improper handling of nested iden and auxl references in Alpha planes during image decoding, letting remote attackers cause memory corruption via crafted files, exploit requires processing a crafted HEIF, HEIC, or AVIF file.

  • 8.1 /10 High
    CVE-2026-84241 No auth

    IBM Guardium Data Protection - Broken Access Control

    IBM Guardium Data Protection 12.2 contains a broken access control caused by improper authorization, letting remote attackers bypass security restrictions, exploit requires network access.

  • 7.6 /10 High
    CVE-2026-84239 Auth required

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in an SQL command, letting remote authenticated attackers obtain sensitive information.

  • 8.1 /10 High
    CVE-2026-84108 No auth

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains a remote code execution caused by improper neutralization of input during web page generation, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 8.9 /10 High
    CVE-2026-84106 Auth required

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains a remote code execution caused by improper neutralization of input during web page generation, letting remote authenticated attackers execute arbitrary code.