Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 485 of 681
- 8.8 /10 HighCVE-2026-76552 Auth required
WP Import Export Lite WordPress plugin - Unrestricted File Upload
WP Import Export Lite WordPress plugin < 3.9.33 contains an unrestricted file upload caused by lack of validation on user-supplied URL files during import, letting users with import permission upload arbitrary files and achieve remote code execution.
- 7.2 /10 HighCVE-2026-76551 Auth required
WP Import Export Lite - Remote Code Execution
WP Import Export Lite WordPress plugin < 3.9.33 contains a remote code execution caused by unrestricted PHP function application on exported field values, letting users with export permission execute arbitrary code remotely, exploit requires export permission.
- 7.2 /10 HighCVE-2026-76550 Auth required
WP Import Export Lite WordPress - Remote Code Execution
WP Import Export Lite WordPress plugin < 3.9.34 contains an unrestricted file write vulnerability caused by lack of validation on user-supplied output path when writing export files, letting users with export permission write arbitrary files leading to remote code execution.
- 10.0 /10 CriticalCVE-2026-76460 CISA KEVPoC publicNo auth
Cisco Identity Services Engine - Authentication Bypass
Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.
- 7.6 /10 HighCVE-2026-76425 Auth required
Cisco ISE - SQL Injection
Cisco ISE contains a SQL injection caused by insufficient validation of parameters concatenated into SQL queries, letting authenticated remote attackers read database content and conduct SSRF attacks, exploit requires valid admin credentials.
- 7.2 /10 HighCVE-2026-76424 Auth required
Cisco ISE - Unrestricted File Upload
Cisco ISE contains an unrestricted file upload vulnerability caused by insufficient validation in REST API file operations, letting authenticated remote attackers upload files and execute commands as root, exploit requires administrative credentials.
- 10.0 /10 CriticalCVE-2026-76423
Cisco ISE - Broken Access Control
Cisco ISE and Cisco ISE-PIC contain a broken access control vulnerability caused by insufficient authorization checks in the REST API web service, letting unauthenticated remote attackers gain administrative access, exploit requires access to the REST API port.
- 9.0 /10 CriticalCVE-2026-76420
Cisco Secure FMC Software - Command Injection
Cisco Secure FMC Software contains a command injection caused by incorrect initialization of encryption parameters in the Apache JServ Protocol (AJP) connector, letting unauthenticated remote attackers execute commands as root, exploit requires sftunnel connection to Cisco Secure FTD Software to be down.
- 8.2 /10 HighCVE-2026-76413
Cisco Adaptive Security Device Manager - Authentication Bypass
Cisco Adaptive Security Device Manager (ASDM) for Cisco Secure FMC Software contains an authentication bypass caused by improper management of the ASDM SSO token, letting unauthenticated remote attackers log in as administrator, exploit requires session token forgery.
- 8.5 /10 HighCVE-2026-76412 Auth required
Cisco Secure FMC Software - Privilege Escalation
Cisco Secure FMC Software contains a privilege escalation vulnerability caused by improper privilege level checks in the remote diagnostics debugger, letting authenticated remote attackers elevate privileges to root, exploit requires valid user credentials.
- 8.8 /10 HighCVE-2026-76409 Auth required
Cisco Nexus Dashboard - Path Traversal
Cisco Nexus Dashboard contains a path traversal vulnerability caused by improper limitation of pathname, letting attackers access unauthorized files, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-76187 No auth
Apache Airflow - Authentication Bypass
Apache Airflow Keycloak provider contains an authentication bypass caused by unauthenticated token endpoint accepting any confidential client credentials in a shared Keycloak realm, letting attackers authenticate as any client, exploit requires valid credentials of any confidential client in the realm.
- 9.1 /10 CriticalCVE-2026-76186 No auth
Apache Airflow - Broken Access Control
Apache Airflow 3.3+ with Keycloak auth manager contains a broken access control caused by separate unauthenticated cookies for Keycloak tokens not bound to session identity, letting logged-in users escalate privileges by pairing foreign tokens, exploit requires valid Airflow login and foreign Keycloak tokens.
- 7.5 /10 HighCVE-2026-76163 No auth
BIND - Denial of Service
BIND 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1 contain a denial of service caused by missing global options block in named.conf leading to assertion failure on TKEY query, letting remote attackers cause program exit, exploit requires crafted TKEY query.
- 9.1 /10 CriticalCVE-2026-75513 Auth required
Marten - SQL Injection
Marten 7.0.0 to 9.13.0 contains a SQL injection caused by unescaped interpolation of attacker-controlled strings into single-quoted SQL literals in LINQ and tenant-management paths, letting attackers bypass filters and exfiltrate or modify data, exploit requires crafted input with single quotes.