Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 596 of 677
- 8.8 /10 HighCVE-2026-85677 No auth
Gutenverse News WordPress - Stored XSS
Gutenverse News WordPress plugin < 3.3.3 contains a stored XSS caused by improper restriction of extra HTML in sanitisation contexts, letting unauthenticated users execute JavaScript in admin and visitor browsers, exploit requires unauthenticated comment submission.
- 9.8 /10 CriticalCVE-2026-84390
Fortinet FortiMonitorOnSight - Information Disclosure
Fortinet FortiMonitorOnSight 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7 contain an information disclosure caused by inclusion of sensitive information in source code, letting attackers access sensitive data, exploit requires unspecified attack vector.
- 7.8 /10 HighCVE-2026-8303 Auth required
TUBITAK BILGEM Pardus-software - Privilege Escalation
TUBITAK BILGEM Pardus-software < 1.0.5 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-8301 Auth required
TUBITAK BILGEM Pardus Boot Repair - OS Command Injection
TUBITAK BILGEM Pardus Boot Repair < 1.0.8 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-82617 No auth
Apache OpenNLP - Denial of Service
Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 contain a denial of service caused by ambiguous nested quantifiers in built-in RegexNameFinder patterns for EMAIL and URL, letting attackers supply crafted text to cause excessive CPU usage or thread crashes, exploit requires attacker to supply untrusted text for analysis.
- 8.3 /10 HighCVE-2026-82583 Auth required
NextGen Connect (Mirth Connect) - SQL Injection
NextGen Connect (Mirth Connect) <= 4.7.1 contains a SQL injection caused by improper sanitization in Database Connector API, letting authenticated users execute arbitrary SQL, leading to credential disclosure, file write, and DoS.
- 7.5 /10 HighCVE-2026-82578
XML Batch Processing - XML External Entity Injection
An XML batch processing component with XPath option enabled contains an XML External Entity (XXE) injection caused by lack of entity restrictions in default XPath/JAXP setup, letting attackers exfiltrate data and cause denial of service, exploit requires XML batch processing with XPath enabled.
- 7.1 /10 HighCVE-2026-81907 No auth
Concrete CMS - Cross-Site Request Forgery
Concrete CMS <= 9.5.2 contains a cross-site request forgery caused by lack of enforcement of CSRF token validation in the Express "Clear Entries" function, letting remote attackers force authenticated administrators to delete entries, exploit requires victim admin to visit attacker-controlled page.
- 7.2 /10 HighCVE-2026-81825 No auth
Simple Ajax Chat - Stored Cross-Site Scripting
Simple Ajax Chat WordPress plugin <= 20260811 contains a stored XSS caused by insufficient input sanitization and output escaping in chat messages, letting unauthenticated attackers inject persistent scripts executed by all users, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-81754 No auth
The Vigilant WordPress - Stored XSS
The Vigilant WordPress plugin <= 2.10.2 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the User-Agent header, letting unauthenticated attackers inject scripts executed on user page access, exploit requires triggering a failed login with crafted User-Agent.
- 8.4 /10 HighCVE-2026-81017
Linux kernel - Out of Bounds Read & Write
Linux kernel platform/chrome sensorhub contains a buffer over-read and write caused by lack of validation of EC-reported sensor number in sensorhub batch_state indexing, letting attackers cause out-of-bounds memory access, exploit requires crafted EC FIFO events.
- 7.7 /10 HighCVE-2026-81016
Linux kernel - Broken Authentication
Linux kernel contains a broken authentication vulnerability caused by improper handling and validation of SMU command return values in platform/x86/amd/pmc, letting attackers cause system instability or denial of service, exploit requires access to trigger SMU commands.
- 7.8 /10 HighCVE-2026-81015
Linux Kernel - Denial of Service
Linux kernel contains a resource leak vulnerability caused by improper cleanup in amd_pmc_probe() when amd_stb_s2d_init() fails, letting attackers cause kernel crashes or unstable system state, exploit requires module reload or s2idle transition.
- 8.4 /10 HighCVE-2026-81012 No auth
Linux kernel - Buffer Overflow
Linux kernel contains an off-by-one write vulnerability in hp_get_string_from_buffer() due to improper boundary check on string length, letting local attackers cause memory corruption, exploit requires local access.
- 7.1 /10 HighCVE-2026-81011 Auth required
Linux kernel - Out-of-Bounds Read
Linux kernel platform/x86 hp-bioscfg contains an out-of-bounds read caused by forwarding incorrect element count to package parsers, letting attackers potentially cause heap read beyond array bounds, exploit requires crafted ACPI package data.