Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 470 of 695
- 7.8 /10 HighCVE-2026-90052 Auth required
Linux kernel dm-integrity - Buffer Overflow
Linux kernel dm-integrity contains a buffer overflow caused by writing a checksum past the end of the allocated buffer in integrity_metadata during keyed discard operations, letting attackers cause memory corruption, exploit requires crafted discard operations.
- 7.8 /10 HighCVE-2026-90051
Linux Kernel - Denial of Service
Linux kernel contains a vulnerability in tcp_sendmsg_locked where devmem tcp tx is not properly enforced without zero-copy, causing potential data copy errors and invariant breaks, letting attackers cause denial of service, exploit requires crafted io_uring requests with dmabuf_id and zero-copy flags.
- 8.8 /10 HighCVE-2026-89036 Auth required
Appwrite - Command Injection
Appwrite before 2.0.0 contains a command injection caused by improper sanitization of the providerRootDirectory parameter in GNU tar commands, letting authenticated users with specific permissions execute arbitrary commands.
- 8.8 /10 HighCVE-2026-88904 Auth required
PuppyFW WordPress plugin - Broken Access Control
PuppyFW WordPress plugin through 0.4.4 contains a broken access control caused by improper authorization on a REST route, letting any authenticated user escalate privileges by modifying blog options.
- 9.0 /10 CriticalCVE-2026-88795 No auth
wpShopGermany IT-RECHT KANZLEI WordPress plugin - Remote Code Execution
wpShopGermany IT-RECHT KANZLEI WordPress plugin < 2.4 contains a remote code execution caused by insecure API authentication token generation derived from requester-controlled data, letting unauthenticated attackers write arbitrary files remotely.
- 8.8 /10 HighCVE-2026-88792 No auth
Dictionary WordPress plugin - Stored XSS
Dictionary WordPress plugin through 1.0 contains a stored XSS caused by lack of authorization, sanitization, and escaping when adding or updating dictionary entries, letting unauthenticated attackers execute arbitrary scripts when viewing entries.
- 8.6 /10 HighCVE-2026-87963 No auth
Yo WordPress - SQL Injection
Yo WordPress plugin 1.1 through 1.3.1 contains a sql injection caused by unsanitized username request parameter in SQL query, letting unauthenticated attackers read arbitrary database contents including admin password hashes, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-87935 No auth
WordPress Paid Downloads - Unrestricted File Upload
WordPress Paid Downloads plugin <= 3.15 contains an unrestricted file upload vulnerability caused by missing authorization and file type validation in admin_request_handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires unauthenticated access to admin-post.php with is_admin() true.
- 7.8 /10 HighCVE-2026-87886 CISA KEVAuth required
Acronis Backup - Privilege Escalation
Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin on Linux before specified builds contain a local privilege escalation caused by insecure file permissions, letting local attackers escalate privileges, exploit requires local access.
- 9.8 /10 CriticalCVE-2026-87796 PoC publicNo auth
Multi Uploader for Gravity Forms - Unrestricted File Upload
Multi Uploader for Gravity Forms WordPress plugin <= 1.1.9 contains an arbitrary file upload vulnerability caused by insufficient file type validation in move_file function during chunked upload handling, letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-87786 No auth
Dewa Kirim WordPress - Stored XSS
Dewa Kirim WordPress plugin through 1.0.0 contains a stored XSS caused by unescaped delivery coordinates in inline scripts, letting unauthenticated users execute JavaScript in administrator sessions, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87742 No auth
quarkus-websockets-next - Denial of Service
quarkus-websockets-next contains a denial of service caused by unbounded message buffering and lack of read backpressure, letting remote attackers exhaust heap space and crash the JVM by streaming messages rapidly.
- 9.6 /10 CriticalCVE-2026-87701 Auth required
Azure Cosmos DB - Privilege Escalation
Azure Cosmos DB contains a privilege escalation caused by improper neutralization of special elements in output used by a downstream component, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.
- 8.8 /10 HighCVE-2026-86864 Auth required
pgAdmin 4 - Command Injection
pgAdmin 4 < 9.18 contains an arbitrary file creation and connection-string injection vulnerability caused by improper validation of the 'database' field in the Backup tool's /backup/job/<sid>/object request, letting authenticated users with tools_backup permission overwrite files and redirect database connections, exploit requires authenticated user with tools_backup permission.
- 9.8 /10 CriticalCVE-2026-86863 No auth
pgAdmin 4 - Authentication Bypass
pgAdmin 4 from 6.2 before 9.18 contains an authentication bypass caused by improper trust of HTTP headers in WebserverAuthentication, letting remote attackers authenticate as any user without credentials, exploit requires 'webserver' enabled in AUTHENTICATION_SOURCES.