Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 504 of 681
- 8.3 /10 HighCVE-2026-90843 No auth
SabyasachiRana WebMap - Command Injection
SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 contains a command injection caused by manipulation of the "target/params" argument in functions_nmap.py New Nmap Scan Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-90841 No auth
PHPGurukul Blood Donor Management System - SQL Injection
PHPGurukul Blood Donor Management System 1.0 contains a SQL injection caused by manipulation of "fromdate" and "todate" arguments in /application/controllers/admin/Report.php Report Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90840 No auth
PHPGurukul Blood Donor Management System - Authentication Bypass
PHPGurukul Blood Donor Management System 1.0 contains an authentication bypass caused by improper authentication in __construct function of /application/controllers/admin/Dashboard.php, letting remote attackers bypass authentication, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-90711 No auth
proxy-addr - Broken Access Control
proxy-addr 1.1.0 through 2.0.7 contains a broken access control caused by incorrect IPv4-mapped IPv6 subnet prefix handling, letting unauthenticated clients bypass IP-based restrictions by controlling X-Forwarded-For header, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-90650 No auth
MotoPress Hotel Booking - Stored XSS
MotoPress Hotel Booking WordPress plugin <= 6.2.4 contains a stored cross-site scripting caused by insufficient sanitization of the Stripe webhook event 'id', letting unauthenticated attackers inject scripts executed when admins view payment logs, exploit requires knowledge of a valid Stripe PaymentIntent ID.
- 9.8 /10 CriticalCVE-2026-89040 No auth
Tencent Mass Service Engine in Cluster (MSEC) - Path Traversal
Tencent Mass Service Engine in Cluster (MSEC) contains a path traversal vulnerability caused by crafted POST requests including '../', letting remote unauthenticated attackers gain root access and execute arbitrary code, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-89026 CISA KEVPoC publicNo auth
Issabel Framework - Authentication Bypass
Issabel Framework before commit b97dbaf contains a hard-coded HS256 JWT signing key in pbxapi index.php, letting unauthenticated remote attackers forge tokens to execute arbitrary OS commands as Asterisk user.
- 7.5 /10 HighCVE-2026-89025 No auth
Hirschmann HiOS Switch Platform - Denial of Service
Hirschmann HiOS Switch Platform contains a denial-of-service vulnerability caused by missing validation of HTTP(S) content in the integrated web server, letting remote unauthenticated attackers cause device reboot, exploit requires sending crafted HTTP(S) request.
- 7.4 /10 HighCVE-2026-89022 No auth
BookStack - Authentication Bypass
BookStack < 26.05.5 contains an authentication bypass caused by improper validation in social login implementation, letting unauthenticated attackers sign in as arbitrary users by exploiting driver_id namespace collision, exploit requires enabled social login providers.
- 7.5 /10 HighCVE-2026-88975 No auth
Http4s - Denial of Service
Http4s prior to 0.23.37 and 1.0.0-M48 contains a denial of service caused by improper HTTP/2 frame size validation in Ember's read loop, letting unauthenticated peers cause memory amplification, exploit requires network access.
- 8.5 /10 HighCVE-2026-88765 Auth required
GitLab EE - Remote Code Execution
GitLab EE 12.3 to 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain a remote code execution caused by Unicode conversion buffer overflow in Advanced Search indexing when importing crafted Git project exports, letting authenticated users execute code remotely, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-88619 Auth required
1024-lab SmartAdmin - Broken Access Control
1024-lab SmartAdmin v3.30.0 contains a broken access control vulnerability caused by missing method-level permission checks in the scheduled-job management module, letting low-privileged authenticated users access admin functionality.
- 9.8 /10 CriticalCVE-2026-88617 No auth
SmartAdmin - Broken Access Control
SmartAdmin v3.30.0 contains a broken access control vulnerability caused by an authorization flaw in the configuration query endpoint, letting remote attackers escalate privileges, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-88616 Auth required
RuoYi-Vue-Plus - Remote Code Execution
RuoYi-Vue-Plus 6.0.0 contains a remote code execution caused by improper handling in FlwTaskController.java and related workflow task components, letting remote attackers execute arbitrary code, exploit requires crafted POST request.
- 7.5 /10 HighCVE-2026-88065 No auth
tts-be - Broken Access Control
tts-be < 2.1.0 contains a broken access control vulnerability across multiple unauthenticated API endpoints, letting remote attackers bypass authorization to enumerate and extract sensitive PII, exploit requires chaining unauthenticated endpoints.