Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 594 of 677

  • 7.5 /10 High
    CVE-2026-89260 No auth

    MoguBlog - XML External Entity Injection

    MoguBlog through 6.2 contains an XML external entity injection caused by unhardened dom4j SAXReader usage in WeChat callback handler at POST /wechat/wechatCheck, letting unauthenticated remote attackers read local files or trigger outbound HTTP requests, exploit requires crafted XML with DOCTYPE declarations.

  • 9.8 /10 Critical
    CVE-2026-89259

    Hugo - File System Read & Write

    Hugo > v0.43 contains a file read and write vulnerability caused by permissive Node tool execution permissions for TailwindCSS, letting attackers read and write files outside the project directory during build, exploit requires use of TailwindCSS.

  • 8.7 /10 High
    CVE-2026-89256 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by lack of encoding of chapter names in the Bookmark plugin, letting video owners inject scripts executed by every visitor on the public watch page, exploit requires video ownership.

  • 8.7 /10 High
    CVE-2026-89255 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by failure to HTML-encode PGP public keys in LoginControl plugin textarea, letting authenticated attackers execute JavaScript in administrator sessions when viewing user profiles.

  • 8.7 /10 High
    CVE-2026-89254 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by unsanitized field_name parameter in CustomizeUser plugin via add.json.php, letting administrators inject scripts that execute on extra info or profile pages, exploit requires admin privileges.

  • 8.7 /10 High
    CVE-2026-89253 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo contains a stored XSS caused by improper validation and encoding of the 'donationLink' user profile field, letting authenticated users inject JavaScript that executes in visitors' browsers, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-89250 No auth

    WWBN AVideo - Unauthorized File Read

    WWBN AVideo contains an unauthenticated file read vulnerability caused by lack of authentication and authorization checks in getRecordedFile.php endpoint, letting attackers download recorded live video files using known or guessed stream keys.

  • 8.7 /10 High
    CVE-2026-89249 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by base64-encoded but unescaped user-supplied CryptoWallet values in YPTWallet plugin, letting attackers execute scripts in admin sessions, exploit requires admin to view pending requests.

  • 8.1 /10 High
    CVE-2026-89243 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo contains a stored XSS caused by lack of sanitization in UserGroups::setGroup_name(), letting administrators with canAdminUserGroups permission inject malicious scripts executed by other administrators, exploit requires admin privileges.

  • 7.2 /10 High
    CVE-2026-89242 No auth

    WWBN AVideo - Server Side Request Forgery

    WWBN AVideo contains a server-side request forgery caused by lack of validation in the _json_decode function fetching remote URLs and local file paths, letting unauthenticated attackers read local files or access internal services via login.json.php.

  • 8.6 /10 High
    CVE-2026-89212 No auth

    Akana API Platform - XML External Entity Injection

    Akana API Platform <= 2026.1, 2025.1.1, and < 2024.1.6 contains an XML external entity injection caused by improper restriction of references during XML-to-JSON processing, letting attackers disclose sensitive information, exploit requires crafted XML input.

  • 8.8 /10 High
    CVE-2026-89178 No auth

    Howyar Technologies WeenyGenius - Origin Validation Error

    Howyar Technologies WeenyGenius contains an origin validation error vulnerability allowing unauthenticated attackers on the same network to spoof teacher workstations and send broadcast packets, causing student computers to connect to the attacker.

  • 8.8 /10 High
    CVE-2026-89177 No auth

    Howyar Technologies WeenyGenius - Use of Insecure Protocol

    Howyar Technologies WeenyGenius contains a use of insecure protocol caused by reliance on ZMTP Null mode, letting unauthenticated attackers on the same network capture packets or perform replay attacks, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-89176 No auth

    Howyar Technologies WeenyGenius - Authentication Bypass

    Howyar Technologies WeenyGenius contains a missing authentication vulnerability allowing unauthenticated attackers on the same network to spoof student or teacher endpoints, letting attackers disrupt classroom operations or gain remote control, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-89174 No auth

    Kingdom Communication Associated Smart Video Intercom System - Authentication Bypass

    Kingdom Communication Associated Smart Video Intercom System contains a missing brute-force protection vulnerability, letting unauthenticated remote attackers gain access to valid accounts through numerous login attempts, exploit requires no special privileges.