Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 697 of 767
- 7.5 /10 HighCVE-2026-88876 No auth
AVideo - Broken Access Control
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a broken access control vulnerability caused by missing authorization in plugin/PlayerSkins/seo.php, letting unauthenticated attackers access password-protected video sources, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-88874 No auth
AVideo - Information Disclosure
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains an information disclosure caused by missing password enforcement on the stats endpoint and HLS origin, letting remote unauthenticated attackers retrieve stream keys and decryption keys to watch password-protected live streams, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-88873 No auth
WWBN AVideo - Cross-Site Request Forgery
WWBN AVideo contains a cross-site request forgery caused by lack of CSRF token validation in view/logArchive.json.php, letting unauthenticated attackers archive logs and truncate live logs via crafted GET requests, exploit requires administrator interaction.
- 7.1 /10 HighCVE-2026-88872 No auth
AVideo - Cross-Site Request Forgery
AVideo contains a cross-site request forgery caused by lack of CSRF token validation in setPassword.json.php endpoint, letting unauthenticated attackers modify any user's channel password via crafted GET requests, exploit requires administrator to visit malicious webpage.
- 7.1 /10 HighCVE-2026-88870 No auth
WWBN AVideo - Cross-Site Request Forgery
WWBN AVideo contains a cross-site request forgery vulnerability caused by missing CSRF token validation in LoginControl plugin PGP key endpoints, letting attackers replace logged-in users' PGP 2FA public keys, exploit requires victim to be logged in.
- 9.3 /10 CriticalCVE-2026-88869 No auth
AVideo - Stored XSS
AVideo contains a stored XSS caused by improper escaping of the "label" parameter in AD_Server plugin's log.php endpoint, letting unauthenticated attackers execute arbitrary JavaScript in admin browser sessions.
- 8.7 /10 HighCVE-2026-88868 Auth required
AVideo - Stored XSS
AVideo contains a stored XSS caused by unsanitized title and description fields in the LiveLinks plugin, letting users with canStream permission execute scripts in visitors' browsers, exploit requires canStream permission.
- 8.7 /10 HighCVE-2026-88867 Auth required
WWBN AVideo - Stored XSS
WWBN AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting caused by unsanitized POST parameters 'name' and 'iconClass' in category creation, letting authenticated users with canUpload permission execute JavaScript in other users' browsers, exploit requires usersCanCreateNewCategories enabled.
- 8.7 /10 HighCVE-2026-88866 Auth required
WWBN AVideo - Stored XSS
WWBN AVideo contains a stored XSS caused by failure to encode the User-Agent header in the LoginControl plugin, letting attackers with valid accounts execute scripts in administrator browsers via Login History page.
- 8.1 /10 HighCVE-2026-88865 Auth required
AVideo - Broken Access Control
AVideo contains a broken access control caused by failure to validate restream ownership in getRestream.json.php, letting authenticated users with canStream permission mint tokens for arbitrary restreams and retrieve other users' stream keys.
- 9.1 /10 CriticalCVE-2026-88864 Auth required
Capgo - Broken Access Control
Capgo contains a broken access control vulnerability caused by unrestricted write access to the public.sso_providers table via Supabase PostgREST, letting attackers with a full API key bypass SSO provisioning controls and enforce arbitrary SSO, exploit requires possession of a full API key.
- 8.1 /10 HighCVE-2026-88863 Auth required
capgo.app capgo - Broken Access Control
capgo.app npm package capgo through 12.207.1 contains a broken access control vulnerability caused by missing role rank comparison in validateInvite() function, letting authenticated users with org.invite_user permission escalate privileges to org_admin or org_billing_admin, exploit requires authenticated user with org.invite_user permission.
- 8.8 /10 HighCVE-2026-88862 Auth required
Capgo - Broken Access Control
Capgo backend through 12.242.4 contains a broken access control vulnerability caused by improper validation of parent-child delegation in API key processing, letting authenticated apikey_manager keys escalate privileges by impersonating more privileged sibling keys, exploit requires authenticated apikey_manager API key.
- 8.3 /10 HighCVE-2026-88861 PoC publicAuth required
Capgo - Authentication Bypass
Capgo contains an authentication bypass caused by improper assurance level validation in Edge JWT middleware and RBAC authorization, letting attackers with only a victim's password perform privileged operations, exploit requires victim's password.
- 7.5 /10 HighCVE-2026-88290 No auth
GeoVision GV-LPC2211 - Denial of Service
GeoVision GV-LPC2211 V1.14 (260903) contains a denial of service caused by unauthenticated clients declaring unbounded VLSVR frame lengths, letting remote attackers exhaust memory and resources, exploit requires no authentication.