Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 604 of 677

  • 7.5 /10 High
    CVE-2026-15462 No auth

    Sticky Chat Widget WordPress - SQL Injection

    Sticky Chat Widget WordPress plugin <= 1.4.2 contains a SQL injection caused by unsanitized 'scw_form_fields' parameter array keys in 'scw_save_form_data' AJAX action, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-14563 No auth

    advanced-customized-prompts WordPress - Authentication Bypass

    advanced-customized-prompts WordPress plugin through 1.0.1 contains an authentication bypass caused by lack of password verification before issuing authenticated sessions, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2026-14560 No auth

    teddy-bear-customize-addon WordPress - Unrestricted File Upload

    teddy-bear-customize-addon WordPress plugin through 1.0.5 contains an unrestricted file upload vulnerability caused by improper validation of uploaded files relying on client-supplied content type and original filename, letting unauthenticated attackers upload and execute arbitrary PHP code on the server, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-14559 No auth

    teddy-bear-customize-addon WordPress - Authentication Bypass

    teddy-bear-customize-addon WordPress plugin through 1.0.5 contains a broken authentication caused by lack of password verification before user authentication, letting unauthenticated attackers log in as any registered user by supplying only the user's email address.

  • 7.3 /10 High
    CVE-2025-15679

    BMC - Authentication Bypass

    BMC contains a broken authentication caused by the root account being activated without a password after a factory reset, letting attackers gain unauthorized access, exploit requires factory reset operation.

  • 7.5 /10 High
    CVE-2026-9166 No auth

    GIS Informatics GisLab Laboratory Management System - Path Traversal

    GIS Informatics GisLab Laboratory Management System >= 1.4.03 < 1.5 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers access unauthorized files, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-9163 No auth

    GIS Informatics GisLab Laboratory Management System - SQL Injection

    GIS Informatics GisLab Laboratory Management System >= 1.4.03 and < 1.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-89094 Auth required

    Forgejo - Remote Code Execution

    Forgejo < 16.0.4 contains a remote code execution caused by mishandled template expansion in .forgejo/template files, letting remote attackers execute arbitrary code, exploit requires crafted template repository.

  • 7.3 /10 High
    CVE-2026-89087 No auth

    OCaml cstruct - Out of Bounds Read

    OCaml cstruct before 6.3.0 contains an out of bounds read caused by mishandling indexes, letting attackers potentially cause denial of service or information disclosure, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-89086 No auth

    jose OCaml - Authentication Bypass

    jose package for OCaml < 0.11.0 contains a broken authentication caused by incomplete RSA signature validation that only checks PKCS #1 decoding without verifying the public key, letting attackers bypass signature verification, exploit requires crafted signature input.

  • 8.2 /10 High
    CVE-2026-89054 No auth

    OpenNMS Horizon - Broken Access Control

    OpenNMS Horizon contains a missing authorization vulnerability caused by lack of authorization enforcement on PATCH endpoints in /api/v2 REST API, letting unauthenticated attackers disable event and SNMP data collection, exploit requires attacker to access the web UI.

  • 9.9 /10 Critical
    CVE-2026-89049 Auth required

    Amazon AWS Systems Manager Agent - Server-Side Request Forgery

    Amazon AWS Systems Manager Agent (SSM Agent) < 3.3.4851.0 contains a server-side request forgery caused by improper validation of equivalent address representations in port forwarding, letting authenticated remote users bypass denylist and access link-local endpoints, exploit requires authentication.

  • 8.2 /10 High
    CVE-2026-89046 No auth

    zstd-jni - Out of Bounds Read

    zstd-jni 1.5.5-6 through 1.5.7-13 contains an out-of-bounds read caused by lack of validation of negative srcPosition arguments in Zstd.getFrameContentSize, letting attackers cause information disclosure or JVM crashes, exploit requires crafted input with negative offset.

  • 7.4 /10 High
    CVE-2026-89043 No auth

    passport-saml-encrypted - Authentication Bypass

    passport-saml-encrypted <= 0.1.13 contains an XML signature wrapping vulnerability caused by independent XPath lookups without cross-validation in signature verification and assertion extraction, letting attackers with any valid signed SAML message bypass authentication, exploit requires attacker to hold a valid signed SAML message.

  • 9.1 /10 Critical
    CVE-2026-89042 No auth

    passport-saml-encrypted - Authentication Bypass

    passport-saml-encrypted <= 0.1.13 contains an authentication bypass caused by conditional SAML signature verification based on an optional cert option, letting attackers submit unsigned SAML responses to bypass authentication, exploit requires no special privileges.