Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 601 of 677

  • 8.2 /10 High
    CVE-2026-78224 No auth

    XSLT Transformer Step - XML External Entity Injection

    XSLT Transformer Step contains an XML External Entity (XXE) injection caused by insecure TransformerFactory configuration, letting attackers exfiltrate data and cause denial-of-service, exploit requires crafted XML input.

  • 7.1 /10 High
    CVE-2026-78134 Auth required

    strongSwan - Broken Access Control

    strongSwan 4.5.0 through 6.0.7 contains an incorrect access control vulnerability caused by missing or mismatched inner EAP identity in eap-ttls and eap-peap plugins, letting attackers bypass access restrictions, exploit requires crafted EAP messages.

  • 7.5 /10 High
    CVE-2026-78133 Auth required

    strongSwan - Use After Free

    strongSwan 6.0.0 through 6.0.7 contains a use-after-free caused by IKEv2 rekeying collision handling in libcharon, letting attackers cause memory corruption, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-78132 No auth

    strongSwan - Denial of Service

    strongSwan 5.1.3 through 6.0.7 contains a denial of service caused by an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax, letting attackers cause service disruption, exploit requires crafted certificate input.

  • 7.5 /10 High
    CVE-2026-78130 No auth

    strongSwan - Denial of Service

    strongSwan 4.2.0 through 6.0.7 contains a null pointer dereference caused by a flaw in the x509 plugin's attribute certificate parser, letting attackers cause denial of service, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-77807

    AcyMailing WordPress Plugin - Path Traversal

    AcyMailing WordPress plugin <= 11.0.4 contains a directory traversal caused by improper sanitization of the `user[name]` parameter, letting unauthenticated attackers read arbitrary files, exploit requires 'Embed images' option enabled.

  • 7.2 /10 High
    CVE-2026-74925 Auth required

    MultiVendorX WordPress plugin - Broken Access Control

    MultiVendorX WordPress plugin < 5.0.16 contains a broken access control vulnerability caused by lack of restrictions on role and capability updates, letting users with vendor role escalate to administrator privileges and take over the site, exploit requires user to have vendor role.

  • 7.5 /10 High
    CVE-2026-73785 No auth

    HPE IceWall Federation Agent and Proxy - Denial of Service

    HPE IceWall Federation Agent and Proxy contains a denial of service vulnerability that allows remote unauthenticated attackers to cause service disruption, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-73784 Auth required

    HPE IceWall - Authentication Bypass

    HPE IceWall contains a broken access control vulnerability caused by tampering of SAML response, letting attackers impersonate other users, exploit requires crafted SAML response.

  • 9.8 /10 Critical
    CVE-2026-72710 No auth

    SPIP - Remote Code Execution

    SPIP before 4.4.18 contains a remote code execution caused by lack of editable columns allowlist in editer_objet action's arg parameter, letting attackers with valid nonce execute arbitrary PHP functions via spip_jobs table injection.

  • 9.8 /10 Critical
    CVE-2026-72709 No auth

    SPIP - Broken Access Control

    SPIP < 4.4.18 contains a missing authorization vulnerability in administrative action endpoints under ecrire/action/ caused by lack of server-side permission checks via autoriser(), letting unauthenticated attackers perform privileged actions including password resets by supplying a valid HMAC-SHA256 nonce.

  • 7.5 /10 High
    CVE-2026-72708 PoC publicNo auth

    SPIP - SQL Injection

    SPIP < 4.4.18 contains an unauthenticated blind SQL injection caused by improper escaping in spip_mysql_cite() for date columns in the public sitemap endpoint, letting attackers extract database content via crafted annee parameter.

  • 7.5 /10 High
    CVE-2026-71646 No auth

    Robotics-STAR-Lab RACER - Denial of Service

    Robotics-STAR-Lab RACER commit abcdef1234567890 contains a denial of service caused by improper handling in FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp, letting attackers cause service disruption, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-71644

    Robotics-STAR-Lab RACER Tested - Unsafe Trajectory Planning

    Robotics-STAR-Lab RACER Tested commit abcdef1234567890 contains an unsafe trajectory planning vulnerability caused by a missing default case in the FSM stopping swarm trajectory publishing when drone enters IDLE, letting attackers cause UAV collisions, exploit requires control over drone state.

  • 7.5 /10 High
    CVE-2026-71641 No auth

    ZJU-FAST-Lab EGO-Planner-v2 - Denial of Service

    ZJU-FAST-Lab EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by interaction issues between traj_server, poscmd_2_odom, and EGOReplanFSM emergency recovery logic, letting attackers cause service disruption remotely, exploit requires no special privileges.