Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 471 of 695

  • 8.8 /10 High
    CVE-2026-86801 No auth

    To Do List Member WordPress plugin - Unrestricted File Upload

    To Do List Member WordPress plugin 1.4 through 1.6 contains an unrestricted file upload caused by an unauthenticated file upload endpoint that lacks authentication and content validation, letting unauthenticated attackers upload, list, and delete files on the site.

  • 9.8 /10 Critical
    CVE-2026-86710 No auth

    Login with QR WordPress plugin - Authentication Bypass

    Login with QR WordPress plugin through 1.0.0 contains an authentication bypass caused by improper verification of login codes, letting unauthenticated attackers log in as any user including administrators, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-86709 No auth

    Pressengine WordPress - Authentication Bypass

    Pressengine WordPress plugin through 1.0 contains an authentication bypass caused by the login handler issuing a session even when authentication fails, letting unauthenticated attackers log in as any user including administrators.

  • 9.8 /10 Critical
    CVE-2026-86707 No auth

    Private Feed WordPress - Authentication Bypass

    Private Feed WordPress plugin through 0.1 contains an authentication bypass caused by improper verification of feed request keys, letting unauthenticated attackers log in as any user including administrators, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-86320

    Flatpak-builder - Command Injection

    Flatpak-builder contains a command injection caused by execution of Git post-applypatch hooks when applying patch sources with use-git-am: true, letting attackers execute arbitrary code with user privileges during build process, exploit requires attacker to provide malicious source.

  • 7.1 /10 High
    CVE-2026-86049

    Jupyter Server - Information Disclosure

    Jupyter Server < 2.21.0 contains an information disclosure vulnerability caused by improper token scrubbing of the Referer header in 5xx request logging, letting attackers with log access recover tokens, exploit requires log access.

  • 7.5 /10 High
    CVE-2026-86040 No auth

    libp2p - Denial of Service

    libp2p prior to 11.0.26 contains a denial of service caused by unauthenticated RPC frames with excessive subscription entries in floodsub, letting remote peers exhaust CPU and memory, exploit requires network access.

  • 8.2 /10 High
    CVE-2026-86039 No auth

    libp2p @libp2p/peer-store - Broken Access Control

    libp2p @libp2p/peer-store 8.0.0 to 12.0.24 contains a broken access control caused by improper verification of PeerRecord.peerId in RecordEnvelope signatures, letting attackers poison address records, exploit requires attacker to sign records with their own key.

  • 7.5 /10 High
    CVE-2026-86038 No auth

    libp2p @libp2p/gossipsub - Authentication Bypass

    libp2p @libp2p/gossipsub 15.0.0 to 16.0.5 contains an authentication bypass caused by improper signature verification binding in buildRawMessage.ts, letting unauthenticated attackers impersonate victim RSA peer IDs, exploit requires crafted message with attacker-controlled keys.

  • 7.5 /10 High
    CVE-2026-85917 No auth

    Azure AI Foundry - Privilege Escalation

    Azure AI Foundry contains a server side request forgery caused by improper request handling, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-85889 No auth

    Azure AI Foundry - Broken Access Control

    Azure AI Foundry contains a broken access control caused by missing authentication for a critical function, letting unauthorized attackers elevate privileges over a network, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-85885 Auth required

    M365 Copilot - Privilege Escalation

    M365 Copilot contains a command injection caused by improper neutralization of special elements in commands, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.

  • 7.5 /10 High
    CVE-2026-85721 PoC publicNo auth

    AsyncHttpClient - Denial of Service

    AsyncHttpClient 2.0.0 to 2.16.1 and 3.0.8 to 3.0.12 contains a denial of service caused by unbounded HTTP response decompression in Http1ContentDecompressor and HTTP/2 decompressor, letting attackers exhaust client heap memory, exploit requires attacker to send crafted compressed responses.

  • 7.5 /10 High
    CVE-2026-85719 No auth

    AsyncHttpClient - Information Disclosure

    AsyncHttpClient 2.1.0 to 2.16.1 and 3.0.12 contain an information disclosure vulnerability caused by attaching Proxy-Authorization headers to requests without confirming HTTP proxy usage, letting attackers access proxy credentials via authenticated SOCKS proxy requests, exploit requires use of authenticated SOCKS proxy.

  • 7.5 /10 High
    CVE-2026-85715 No auth

    ExifReader - Denial of Service

    ExifReader < 4.41.1 contains a denial of service caused by unbounded allocation of extent objects when parsing crafted HEIC or AVIF ISO-BMFF files with zero field widths in iloc box, letting attackers exhaust system memory remotely, exploit requires parsing attacker-controlled files.