Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 472 of 695
- 8.8 /10 HighCVE-2026-85130 No auth
WPLP Cookie Consent - Stored XSS
WPLP Cookie Consent WordPress plugin < 4.4.4 contains a stored XSS caused by unescaped user input in a public endpoint output in JavaScript context on admin screens, letting unauthenticated attackers execute arbitrary JavaScript in administrator sessions, exploit requires multisite installation.
- 7.5 /10 HighCVE-2026-85128
Choose User Role at Registration WordPress - Broken Access Control
Choose User Role at Registration WordPress plugin < 1.3.3 contains a broken access control vulnerability caused by lack of validation of requested roles at registration, letting unauthenticated users request and be granted any role including administrator, exploit requires role selection feature and public account registration enabled.
- 8.2 /10 HighCVE-2026-85077 No auth
Sanic - HTTP Response Splitting
Sanic < 24.12.1 and 25.12.0 contain an HTTP response splitting vulnerability caused by improper sanitization of header names and values in response serialization, letting attackers inject headers and split responses, exploit requires attacker-controlled data in headers or cookies.
- 10.0 /10 CriticalCVE-2026-83944 No auth
Azure Logic Apps - Broken Access Control
Azure Logic Apps contains an improper access control vulnerability allowing unauthorized attackers to elevate privileges over a network, exploit requires network access.
- 7.7 /10 HighCVE-2026-81546 No auth
Affinity by Canva - Remote Code Execution
Affinity by Canva < 3.3.0 contains a buffer overflow caused by inadequate bounds checking when parsing document files, letting attackers execute arbitrary code when a crafted document is opened, exploit requires user to open malicious file.
- 7.5 /10 HighCVE-2026-81516 No auth
Steeltoe - Denial of Service
Steeltoe 4.0.0 to 4.3.0 contains a denial of service caused by strict Boolean conversion of secure metadata in ConsulDiscoveryClient, letting attackers cause service discovery outage by registering malformed service data.
- 7.5 /10 HighCVE-2026-81515 No auth
Steeltoe - Denial of Service
Steeltoe 4.0.0 to 4.3.0 contains a denial of service caused by malformed registry response deserialization in EurekaDiscoveryClient, letting principals that can register or update instances cause clients to receive empty or stale instance lists, exploit requires instance registration or update privileges.
- 7.5 /10 HighCVE-2026-81481 No auth
Dell OpenManage Server Administrator - Path Traversal
Dell OpenManage Server Administrator < 11.1.0.3 contains a path traversal caused by improper limitation of pathname to restricted directory, letting unauthenticated remote attackers access filesystem paths, exploit requires remote access.
- 7.2 /10 HighCVE-2026-81480 Auth required
Dell OpenManage Server Administrator - Buffer Overflow
Dell OpenManage Server Administrator < 11.1.0.3 contains a stack-based buffer overflow caused by improper handling of input, letting high privileged remote attackers execute arbitrary code.
- 8.1 /10 HighCVE-2026-81478 No auth
Dell OpenManage Server Administrator - Authentication Bypass
Dell OpenManage Server Administrator < 11.1.0.3 contains a hardcoded cryptographic key vulnerability, letting unauthenticated remote attackers gain unauthorized access, exploit requires remote access without authentication.
- 7.2 /10 HighCVE-2026-81477 Auth required
Dell OpenManage Server Administrator - Buffer Overflow
Dell OpenManage Server Administrator < 11.1.0.3 contains a heap-based buffer overflow caused by improper memory handling, letting high privileged remote attackers execute arbitrary code.
- 8.1 /10 HighCVE-2026-81476 No auth
Dell OpenManage Server Administrator - OS Command Injection
Dell OpenManage Server Administrator < 11.1.0.3 contains an OS command injection caused by improper neutralization of special elements, letting unauthenticated remote attackers execute arbitrary commands remotely, exploit requires remote access.
- 8.1 /10 HighCVE-2026-81475 No auth
Dell OpenManage Server Administrator - Authentication Bypass
Dell OpenManage Server Administrator < 11.1.0.3 contains a missing authentication for critical function vulnerability, letting unauthenticated remote attackers execute commands remotely, exploit requires remote access.
- 7.8 /10 HighCVE-2026-81474 Auth required
Dell OpenManage Server Administrator - Elevation of Privileges
Dell OpenManage Server Administrator < 11.1.0.3 contains a heap-based buffer overflow caused by improper memory handling, letting low privileged local attackers escalate privileges, exploit requires local access.
- 7.4 /10 HighCVE-2026-81446 No auth
Dell OpenManage Server Administrator - Server-Side Request Forgery
Dell OpenManage Server Administrator < 11.1.0.3 contains a server-side request forgery vulnerability caused by improper request validation, letting unauthenticated remote attackers induce server-side requests, exploit requires remote network access.