Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 611 of 677

  • 8.6 /10 High
    CVE-2026-85217 No auth

    Autodesk Fusion Desktop - Broken Access Control

    Autodesk Fusion Desktop contains a broken access control vulnerability caused by a maliciously crafted add-in modifying persistent network proxy settings without user consent, letting attackers redirect authenticated network traffic, exploit requires add-in installation and execution.

  • 9.8 /10 Critical
    CVE-2026-85025 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper enforcement of public-flow security restrictions and session isolation controls in MCP project endpoints, letting unauthenticated attackers execute arbitrary code and access or modify chat sessions, exploit requires publicly shared MCP project endpoints.

  • 9.1 /10 Critical
    CVE-2026-84939 No auth

    Apache FreeMarker - Path Traversal

    Apache FreeMarker 2.2.0 through 2.3.34 contains a path traversal caused by specifying a malformed locale identifier with localized lookup enabled, letting attackers access unintended template files, exploit requires localized lookup enabled.

  • 8.8 /10 High
    CVE-2026-84889 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.10.3 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting remote authenticated attackers execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-84821 No auth

    WP Fast Total Search - Broken Access Control

    WP Fast Total Search <= 1.82.284 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-84819 No auth

    WPAdverts - Reflected XSS

    WPAdverts <= 2.3.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-84816 No auth

    WPCS - Reflected XSS

    WPCS <= 1.3.2 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.8 /10 High
    CVE-2026-84042 Auth required

    crun - Privilege Escalation

    crun >= 1.29 contains a privilege escalation caused by executing attacker-controlled payload from container image with host root privileges when built with libkrun and rootful passt networking, letting attackers gain host root privileges, exploit requires rootful container with passt networking enabled.

  • 9.3 /10 Critical
    CVE-2026-8323 No auth

    Armiya Information Technologies Ltd. Co. Access Control System - Open Redirect

    Armiya Information Technologies Ltd. Co. Access Control System < 2 contains an open redirect vulnerability caused by improper validation of redirect URLs, letting attackers redirect users to untrusted sites, exploit requires user interaction.

  • 8.1 /10 High
    CVE-2026-82925 No auth

    Site Reviews WordPress - Insecure Deserialization

    Site Reviews WordPress plugin < 8.3.0 contains an insecure deserialization vulnerability caused by predictable key derivation from WordPress nonce key, letting unauthenticated users inject arbitrary PHP objects, exploit requires weak or default nonce key.

  • 9.6 /10 Critical
    CVE-2026-82107 Auth required

    IBM DataStage - Authentication Bypass

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a broken authentication caused by improper authentication, letting remote authenticated attackers obtain sensitive information and bypass security restrictions.

  • 9.6 /10 Critical
    CVE-2026-82100 Auth required

    IBM DataStage on Cloud Pak for Data - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper input validation, letting remote authenticated attackers cause denial of service, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-82099 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82098 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 8.8 /10 High
    CVE-2026-82097 Auth required

    IBM DataStage on Cloud Pak for Data - Remote Code Execution

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a server-side request forgery caused by improper validation of URLs, letting remote authenticated attackers execute arbitrary code.