Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 603 of 677
- 8.3 /10 HighCVE-2026-54174
Melange Apko - Package Integrity Bypass
Melange < 0.50.4 and Apko < 1.2.9 contain a package tampering vulnerability caused by missing verification of data section hash in APK packages, letting attackers substitute arbitrary files via mirror compromise or MITM, exploit requires attacker to control package source.
- 7.1 /10 HighCVE-2026-54166 Auth required
Shelf - Server-Side Request Forgery
Shelf prior to version 1.20.3 contains a server-side request forgery caused by bypassing imageUrl validation in the Asset CSV Content Import feature, letting authenticated users with asset:import permission make arbitrary server requests, exploit requires authenticated user with asset:import permission.
- 7.5 /10 HighCVE-2026-54135 No auth
AirSane - Denial of Service
AirSane < 0.4.12 contains a denial of service caused by improper validation of Content-Length header in the custom HTTP server, letting remote unauthenticated attackers crash the service via memory exhaustion.
- 9.3 /10 CriticalCVE-2026-54072 No auth
Authorizer - Open Redirect
Authorizer prior to 2.2.1 contains an open redirect vulnerability caused by lack of validation of redirect_uri in /authorize endpoint, letting unauthenticated attackers steal tokens via attacker-supplied URLs, exploit requires attacker to obtain client_id from public endpoint.
- 9.8 /10 CriticalCVE-2026-53952 No auth
GetSimple CMS - Authentication Bypass
GetSimple CMS <= 3.4.0a and GetSimpleCMS-CE <= 3.3.22 contain an authentication bypass caused by a logic flaw in the automated deletion of admin/setup.php, letting unauthenticated attackers create new admin accounts, exploit requires access to setup script post-installation.
- 9.8 /10 CriticalCVE-2026-52630 No auth
Woltlab WCF - SQL Injection
Woltlab WCF <= 6.2.4 contains a SQL injection caused by improper sanitization in UserEditor.class.php and UserAction.class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted requests.
- 7.5 /10 HighCVE-2026-50013 No auth
Hoverfly - Denial of Service
Hoverfly < 1.12.8 contains a denial of service caused by unsynchronized concurrent writes to the shared responsesDiff map in Diff mode, letting attackers crash the process by sending multiple simultaneous requests.
- 7.5 /10 HighCVE-2026-49846 No auth
libks - Path Traversal
libks < 2.0.11 contains a path traversal vulnerability caused by improper URI canonicalization in clean_uri() allowing embedded ".." sequences to bypass checks, letting attackers access arbitrary filesystem paths, exploit requires crafted URI with excessive path segments.
- 8.1 /10 HighCVE-2026-49464 Auth required
NL Portal Backend Libraries nl.nl-portal:taak - Broken Access Control
NL Portal Backend Libraries nl.nl-portal:taak 1.5.0 through 3.0.0 contains a broken access control vulnerability caused by failure to verify ownership in submitTaakV2 GraphQL mutation, letting authenticated users read, overwrite, and complete other users' tasks, exploit requires authentication.
- 8.1 /10 HighCVE-2026-38058 Auth required
iDirect iQ200 VSAT terminal - Authentication Bypass
iDirect iQ200 VSAT terminal contains an information disclosure vulnerability caused by returning complete device configuration including MD5-crypt password hashes in the SECURITY section, letting authenticated users extract and crack password hashes offline, exploit requires valid web credentials.
- 8.8 /10 HighCVE-2026-38056 Auth required
iDirect iQ200 - Privilege Escalation
iDirect iQ200 VSAT terminal firmware 23.0.1.0 contains a local privilege escalation caused by insufficient privilege restrictions on a pre-configured low-privilege local user account, letting local attackers gain administrative control, exploit requires access to the built-in low-privilege account.
- 8.1 /10 HighCVE-2026-19991 Auth required
UsersWP WordPress Plugin - Arbitrary File Deletion
UsersWP WordPress plugin <= 1.2.70 contains an arbitrary file deletion vulnerability caused by improper validation and normalization of file paths in upload_file_remove() AJAX handler, letting authenticated subscribers delete arbitrary files.
- 7.2 /10 HighCVE-2026-18579 No auth
WP Photo Album Plus - Stored XSS
WP Photo Album Plus for WordPress <= 9.2.08.003 contains a stored cross-site scripting caused by insufficient sanitization of 'HTTP_X_FORWARDED_FOR' parameter, letting unauthenticated attackers inject scripts executed on user page access.
- 7.5 /10 HighCVE-2026-18561 No auth
Unlimited Elements For Elementor - SQL Injection
Unlimited Elements For Elementor for WordPress <= 2.0.16 contains a SQL injection caused by insufficient escaping of the 'addontype' parameter in getWhereString(), letting unauthenticated attackers extract sensitive database information, exploit requires crafted array input.
- 7.2 /10 HighCVE-2026-17037 No auth
Kirki Freeform Page Builder - Stored XSS
Kirki Freeform Page Builder plugin for WordPress <= 6.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access the page.