Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 606 of 677

  • 7.7 /10 High
    CVE-2026-88883

    Renovate - Information Disclosure

    Renovate before 44.14.4 contains an information disclosure vulnerability caused by incomplete log sanitisation of TLS private keys in Mutual TLS configurations, letting attackers with log access recover private keys, exploit requires access to logs containing unsanitized keys.

  • 8.6 /10 High
    CVE-2026-88882

    Renovate - Information Disclosure

    Renovate before 44.11.2 and related Mend Renovate CE/EE images and charts contain an information disclosure vulnerability caused by following pagination URLs in NuGet registry Link headers without origin verification, letting attackers on malicious registries receive registry credentials, exploit requires a malicious or compromised NuGet registry.

  • 8.6 /10 High
    CVE-2026-88881

    Renovate - Information Disclosure

    Renovate contains an information disclosure vulnerability caused by unvalidated pagination URLs in the HTTP Link header, letting attackers on compromised GitHub servers obtain credentials, exploit requires a malicious or compromised GitHub server.

  • 8.6 /10 High
    CVE-2026-88880

    Renovate - Open Redirect

    Renovate before 44.11.3 contains an open redirect caused by improper validation of Link header destinations when following GitLab server pagination, letting attackers controlling a compromised GitLab server exfiltrate authentication credentials, exploit requires attacker control of GitLab server.

  • 8.2 /10 High
    CVE-2026-88879 No auth

    Traefik - Authentication Bypass

    Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 contain a HTTP header smuggling vulnerability caused by inconsistent header canonicalization, letting remote attackers bypass middleware identity checks, exploit requires crafted headers with dot-form aliases.

  • 9.8 /10 Critical
    CVE-2026-88877 PoC publicNo auth

    Traefik - Authentication Bypass & Broken Access Control

    Traefik v3.7.0 to v3.7.11 contains a broken access control vulnerability caused by mishandling of Kubernetes ingress-nginx annotations, letting attackers bypass authentication and other middlewares, exploit requires crafted Host header with non-numeric or empty port.

  • 7.5 /10 High
    CVE-2026-88876 No auth

    AVideo - Broken Access Control

    AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a broken access control vulnerability caused by missing authorization in plugin/PlayerSkins/seo.php, letting unauthenticated attackers access password-protected video sources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-88874 No auth

    AVideo - Information Disclosure

    AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains an information disclosure caused by missing password enforcement on the stats endpoint and HLS origin, letting remote unauthenticated attackers retrieve stream keys and decryption keys to watch password-protected live streams, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-88873 No auth

    WWBN AVideo - Cross-Site Request Forgery

    WWBN AVideo contains a cross-site request forgery caused by lack of CSRF token validation in view/logArchive.json.php, letting unauthenticated attackers archive logs and truncate live logs via crafted GET requests, exploit requires administrator interaction.

  • 7.1 /10 High
    CVE-2026-88872 No auth

    AVideo - Cross-Site Request Forgery

    AVideo contains a cross-site request forgery caused by lack of CSRF token validation in setPassword.json.php endpoint, letting unauthenticated attackers modify any user's channel password via crafted GET requests, exploit requires administrator to visit malicious webpage.

  • 7.1 /10 High
    CVE-2026-88870 No auth

    WWBN AVideo - Cross-Site Request Forgery

    WWBN AVideo contains a cross-site request forgery vulnerability caused by missing CSRF token validation in LoginControl plugin PGP key endpoints, letting attackers replace logged-in users' PGP 2FA public keys, exploit requires victim to be logged in.

  • 9.3 /10 Critical
    CVE-2026-88869 No auth

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by improper escaping of the "label" parameter in AD_Server plugin's log.php endpoint, letting unauthenticated attackers execute arbitrary JavaScript in admin browser sessions.

  • 8.7 /10 High
    CVE-2026-88868 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by unsanitized title and description fields in the LiveLinks plugin, letting users with canStream permission execute scripts in visitors' browsers, exploit requires canStream permission.

  • 8.7 /10 High
    CVE-2026-88867 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting caused by unsanitized POST parameters 'name' and 'iconClass' in category creation, letting authenticated users with canUpload permission execute JavaScript in other users' browsers, exploit requires usersCanCreateNewCategories enabled.

  • 8.7 /10 High
    CVE-2026-88866 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo contains a stored XSS caused by failure to encode the User-Agent header in the LoginControl plugin, letting attackers with valid accounts execute scripts in administrator browsers via Login History page.