Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 612 of 677

  • 8.8 /10 High
    CVE-2026-82095 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82092 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers obtain sensitive information, exploit requires authentication.

  • 8.4 /10 High
    CVE-2026-82079 No auth

    Nintendo Switch - Buffer Overflow

    Nintendo Switch < 23.0.0 contains a buffer overflow caused by improper handling in local wireless networking, letting attackers within wireless range execute arbitrary code via crafted network traffic.

  • 8.8 /10 High
    CVE-2026-81941 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by an authenticated non-administrative user constructing a flow with an MCP Tools component using local stdio subprocess transport, letting attackers execute arbitrary OS commands at application privilege level, exploit requires authenticated non-administrative user.

  • 8.8 /10 High
    CVE-2026-81940 Auth required

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by improper neutralization of special characters in flow display names, letting remote authenticated attackers execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-81805 No auth

    SiteSkite - Privilege Escalation

    SiteSkite <= 2.1.5 contains a privilege escalation vulnerability allowing unauthenticated attackers to escalate privileges without authentication.

  • 7.5 /10 High
    CVE-2026-81804 No auth

    ZHBackup – Backup, Restore & Migration - Information Disclosure

    ZHBackup – Backup, Restore & Migration <= 2.4.2 contains an information disclosure vulnerability caused by unauthenticated access, letting remote attackers access sensitive data without authentication.

  • 7.5 /10 High
    CVE-2026-81803 Auth required

    RepairBuddy - Remote Code Execution

    RepairBuddy <= 4.1224 contains a remote code execution caused by unspecified vulnerability, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 8.1 /10 High
    CVE-2026-81801 Auth required

    WP-Stateless - Broken Access Control

    WP-Stateless <= 4.4.1 contains a subscriber settings change vulnerability caused by improper handling of subscriber settings, letting attackers modify subscriber configurations, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-81800 No auth

    Verified Reviews (Avis Vérifiés) - SQL Injection

    Verified Reviews (Avis Vérifiés) <= 2.4.6 contains an unauthenticated SQL injection caused by improper input sanitization, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81799 No auth

    Return Refund and Exchange For WooCommerce - Broken Access Control

    Return Refund and Exchange For WooCommerce <= 4.6.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.3 /10 High
    CVE-2026-81796 No auth

    WP Travel - Authentication Bypass

    WP Travel <= 12.0.3 contains a broken authentication vulnerability allowing unauthenticated attackers to bypass authentication, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-81795 No auth

    Page Visits Counter - Lite - Reflected XSS

    Page Visits Counter - Lite <= 1.2.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81794 No auth

    Shirt Product Designer for WooCommerce - Broken Access Control

    Shirt Product Designer for WooCommerce 1.0.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.6 /10 High
    CVE-2026-81789 No auth

    Advanced Product Fields Extended for WooCommerce - Unrestricted File Deletion

    Advanced Product Fields Extended for WooCommerce <= 3.1.6 contains an unrestricted file deletion vulnerability caused by improper input validation, letting unauthenticated attackers delete arbitrary files remotely, exploit requires no authentication.