Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 706 of 767
- 9.1 /10 CriticalCVE-2026-78361 No auth
zipMoney(Zip Co) Payments Plugin for WooCommerce - Broken Access Control
zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin < 2.4.0 contains a broken access control vulnerability caused by lack of authorization checks on a front-end request handler, letting unauthenticated attackers delete arbitrary WordPress options, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-77771 PoC publicAuth required
miniOrange 2FA WordPress plugin - Authentication Bypass
miniOrange 2FA WordPress plugin < 6.3.1 and < 19.3 contains a broken authentication caused by improper scoping of second-factor attempt limits, letting attackers with victim's password bypass second factor by unlimited OTP guesses, exploit requires attacker to know victim's password.
- 10.0 /10 CriticalCVE-2026-77770 PoC publicNo auth
miniOrange 2FA WordPress plugin - Broken Access Control
miniOrange 2FA WordPress plugin < 6.3.1 and < 19.3 contains a broken access control vulnerability caused by lack of validation on transaction before deleting site options from unauthenticated input, letting unauthenticated visitors delete arbitrary options, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-76562 No auth
Sidebar Manager Light WordPress - Stored XSS
Sidebar Manager Light WordPress plugin <= 1.18 contains a stored XSS caused by insufficient sanitization and escaping of 'sbm_description' parameter, letting unauthenticated attackers execute arbitrary scripts on user page access.
- 8.8 /10 HighCVE-2026-76059 Auth required
IBM Langflow OSS - Command Injection
IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by a logic error in static security scanner allowing bypass via crafted annotated class-body assignment, letting attackers execute arbitrary OS commands with service privileges, exploit requires submission of custom component source code.
- 9.1 /10 CriticalCVE-2026-75940 No auth
Lenovo Health Android Application - Information Disclosure
Lenovo Health Android Application contains an information disclosure vulnerability that allows attackers to access sensitive health-related information, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-75777 Auth required
IBM Aspera Enterprise WebApps - Privilege Escalation
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 contains a container escape vulnerability caused by unrestricted system calls within the container, letting local attackers escape container protections, exploit requires local access.
- 8.8 /10 HighCVE-2026-75624 Auth required
IBM App Connect Enterprise - Broken Access Control
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 contain a broken access control caused by incorrect authorization, letting remote authenticated attackers bypass security restrictions.
- 7.5 /10 HighCVE-2026-75584 No auth
ION-DTN - Denial of Service
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability caused by improper validation of zero-length payload in BPv7 bundles in canonicalizePayloadBlock(), letting unauthenticated remote attackers crash the process, exploit requires sending a crafted bundle with zero-length payload.
- 7.2 /10 HighCVE-2026-73699 Auth required
FileRun - Remote Code Execution
FileRun < 2026.3.0 contains a PHP object injection caused by incorrect options passed to unserialize() in Perms::getPerms(), letting authenticated attackers execute arbitrary code and write files, exploit requires database write access.
- 7.2 /10 HighCVE-2026-73698 Auth required
FileRun - SQL Injection & Remote Code Execution
FileRun < 2026.3.0 contains a SQL injection caused by improper handling of the description parameter as an array in DB/DP.php, letting delegated or simple administrators escalate privileges and potentially execute code, exploit requires administrator privileges.
- 7.2 /10 HighCVE-2026-73694 Auth required
FileRun - OS Command Injection
FileRun < 2026.3.0 contains an OS command injection caused by no-op redefinition of escapeshellcmd() in CLI.php, letting attackers execute arbitrary commands via crafted input, exploit requires superuser authentication.
- 8.8 /10 HighCVE-2026-73693 Auth required
FileRun - Command Injection
FileRun before 2026.3.0 contains a command injection caused by missing escapeshellarg() sanitization in the PhotoProofSheet handler, letting authenticated users with upload permission execute arbitrary OS commands via crafted filenames.
- 9.8 /10 CriticalCVE-2026-7188 No auth
Armiya Information Technologies Ltd. Co. Access Control System - SQL Injection
Armiya Information Technologies Ltd. Co. Access Control System < 2 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-71647 No auth
EGO-Planner-v2 - Denial of Service
EGO-Planner-v2 <= 5c99a95880401e2599638d567abc0e240396cb42 contains a denial of service caused by improper handling in checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions in ego_replan_fsm.cpp, letting attackers cause service disruption remotely, exploit requires no special privileges.