Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 576 of 677
- 10.0 /10 CriticalCVE-2026-81648 PoC publicNo auth
CryptoPayment Gateway WordPress plugin - Broken Access Control
CryptoPayment Gateway WordPress plugin 1.2.1 to 1.2.2 contains a broken access control caused by missing authorization check on an AJAX endpoint, letting unauthenticated attackers perform administrative operations including file deletion and credential recovery.
- 7.2 /10 HighCVE-2026-80071 Auth required
User Registration & Membership WordPress plugin - Broken Access Control
User Registration & Membership WordPress plugin < 5.2.8 contains a broken access control vulnerability caused by improper restriction and validation of membership plan authorship, letting authenticated users with Author-level access escalate privileges to Administrator, exploit requires authenticated Author-level access or higher.
- 8.8 /10 HighCVE-2026-74933 No auth
GenieWords WordPress - Stored XSS
GenieWords WordPress plugin 1.5.27 to 1.5.34 contains a stored XSS caused by lack of authorization checks and decoding stored values before output in REST API and AJAX actions, letting unauthenticated attackers inject scripts executing on front-end pages.
- 8.1 /10 HighCVE-2026-37008
CrewAI - Sandbox Bypass
CrewAI before fb2323b contains a sandbox bypass caused by improper Python blocklist implementation at import-time, letting attackers execute arbitrary code via runtime object graph access, exploit requires code execution capability.
- 7.4 /10 HighCVE-2026-36453 Auth required
Rhymix - Broken Access Control
Rhymix < 2.1.31 contains an insecure direct object reference caused by improper access control on extra variables, letting attackers access arbitrary files, exploit requires crafted request with specific variables.
- 7.7 /10 HighCVE-2026-29811
CyberPanel - Authentication Bypass
CyberPanel before 2.4.4 contains a logic flaw caused by improper alias domain detection via ORM query filter instead of Python conditional, letting attackers potentially bypass domain alias checks, exploit requires crafted domain requests.
- 7.5 /10 HighCVE-2026-15891 No auth
MQTT-SN Client - Denial of Service
The MQTT-SN client contains a denial of service vulnerability caused by improper handling of gateway records in the keepalive handler, leading to NULL pointer dereference and kernel panic when PINGREQ retries are exhausted, letting remote attackers cause a crash without authentication.
- 7.4 /10 HighCVE-2026-90647 No auth
ASE/Kalkitech ASE2000 V2 - Man-in-the-Middle
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 contains a man-in-the-middle vulnerability caused by improper certificate validation in the IEC 60870-5-104 TLS client (Task Mode), letting network-positioned attackers intercept protected communications, exploit requires attacker to be positioned on the network.
- 7.4 /10 HighCVE-2026-90616 No auth
Flatpak - Sandbox Escape & Arbitrary Code Execution
Flatpak < 1.18.1 contains a sandbox escape vulnerability caused by missing symlink protection in app data directories, letting malicious sandboxed apps gain arbitrary read/write and code execution on the host, exploit requires attacker-controlled symlinks.
- 8.2 /10 HighCVE-2026-90560 No auth
zstd-jni - Denial of Service
zstd-jni 1.2.0 through 1.5.7-13 contains an out-of-bounds read vulnerability caused by lack of validation of offset and length arguments in ZstdDictDecompress constructor, letting attackers cause JVM termination by reading memory past array bounds, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-90559 No auth
snappy-java - Buffer Overflow
snappy-java through 1.1.10.8 contains a buffer overflow caused by lack of validation of destination buffer capacity in Snappy.uncompress(ByteBuffer, ByteBuffer), letting attackers cause JVM termination by writing past buffer boundaries, exploit requires crafted compressed data.
- 9.8 /10 CriticalCVE-2026-90558 No auth
sngrep - Buffer Overflow
sngrep <= 1.8.4 contains a stack buffer overflow caused by improper handling of oversized SIP header values in attribute formatting routines, letting attackers execute arbitrary code or cause crashes during packet parsing.
- 7.8 /10 HighCVE-2026-90556 No auth
Freeciv - Buffer Overflow
Freeciv < 3.2.6 contains a heap buffer overflow caused by processing savegame files with worklist lengths exceeding array bounds in worklist_load(), letting attackers corrupt memory when loading crafted savegame files, exploit requires loading malicious savegame.
- 7.8 /10 HighCVE-2026-90553 No auth
vLLM - Remote Code Execution
vLLM < 0.28.0 contains a remote code execution caused by ignoring the trust_remote_code parameter in LlavaOnevision2 processor loader, letting attackers execute arbitrary code with vLLM process authority, exploit requires crafted malicious model.
- 8.2 /10 HighCVE-2026-90537 No auth
WWBN AVideo - Broken Access Control
WWBN AVideo contains a missing authorization vulnerability caused by insufficient access control in plugin/Scheduler/sendEmail.json.php, letting unauthenticated attackers enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by providing a valid site-wide daily token.