Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 557 of 677

  • 8.3 /10 High
    CVE-2026-90691 No auth

    0x4m4 HexStrike AI - Path Traversal

    0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 contains a path traversal caused by manipulation of the "filename" argument in FileOperationsManager of hexstrike_server.py API Files Endpoint, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90690 No auth

    0x4m4 HexStrike AI - Command Injection

    0x4m4 HexStrike AI contains a command injection caused by manipulation of arguments in subprocess.Popen in hexstrike_server.py API Tools Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-90689 Auth required

    Tenda W20E - Buffer Overflow

    Tenda W20E 15.11.0.61068_1546_841_CN_TDC contains a stack-based buffer overflow caused by manipulation of the argument webAuthWhiteUserIndex in formDelWebAuthWhiteUser, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-90680 Auth required

    D-Link DIR-823G - Buffer Overflow

    D-Link DIR-823G 1.0.2B05_20181207 contains a stack-based buffer overflow caused by improper handling of PAddress/SubnetMask/Gateway arguments in /HNAP1/SetStaticRouteSettings, letting remote attackers execute code, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-90620 No auth

    0x4m4 HexStrike AI - Authentication Bypass

    0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04 contains an authentication bypass caused by missing authentication in API Command Endpoint, letting remote attackers bypass authentication, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-90619 No auth

    0x4m4 HexStrike AI - Command Injection

    0x4m4 HexStrike AI contains a command injection caused by manipulation of the "code/script" argument in hexstrike_server.py Execute Endpoint, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-90618 No auth

    GH05TCREW PentestAgent - Command Injection

    GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2 contains a command injection caused by manipulation in LocalRuntime.execute_command in runtime/runtime.py, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-90617 No auth

    GH05TCREW PentestAgent - Command Injection

    GH05TCREW PentestAgent contains a command injection caused by manipulation in run_task function of MCP HTTP Server component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90608 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "service_type" argument in /boafrm/formPortFw component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90607 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formNewSchedule component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90606 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "static_ipv6" argument in /boafrm/formIpv6Setup component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90605 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "ip6addr" argument in /boafrm/formFilter component boa, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-89180 No auth

    Thinking Software Technology EFence - SQL Injection

    Thinking Software Technology EFence contains a sql injection caused by improper input sanitization, letting unauthenticated remote attackers inject arbitrary SQL commands to read database contents, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-89023 No auth

    ThemeAtelier Domain For Sale - Broken Access Control

    ThemeAtelier Domain For Sale plugin for WordPress < 3.5.2 contains a broken access control vulnerability in REST API endpoints, letting unauthenticated attackers access and manipulate protected resources, including offer records and bidder information.

  • 7.1 /10 High
    CVE-2026-8821 Auth required

    Mattermost - Broken Access Control

    Mattermost 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 contains a broken access control caused by failure to validate channel member-management permission during playbook run creation, letting authenticated channel members add arbitrary users to restricted channels via the run owner field, exploit requires authentication.