Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 710 of 767
- 8.0 /10 HighCVE-2026-14873 Auth required
Bulk Password Reset WordPress plugin - Privilege Escalation
Bulk Password Reset WordPress plugin <= 1.3.3 contains a privilege escalation via account takeover caused by improper user identity validation before updating user details, letting authenticated attackers with subscriber-level access change arbitrary user emails and reset passwords.
- 7.8 /10 HighCVE-2026-11813 Auth required
Lenovo Filez Client - Privilege Escalation
Lenovo Filez Client contains an improper permissions vulnerability that allows local authenticated users to escalate privileges by exploiting incorrect permission settings.
- 7.2 /10 HighCVE-2026-0310
Palo Alto Networks PAN-OS - Buffer Overflow
Palo Alto Networks PAN-OS contains a buffer overflow caused by improper XML processing, letting unauthenticated attackers with network access cause denial of service or execute arbitrary code with root privileges, exploit requires network access to management or dataplane interface.
- 7.5 /10 HighCVE-2025-57231 PoC publicNo auth
Docmost - Path Traversal
Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL.
- 7.1 /10 HighCVE-2026-87999 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI < 0.11.1 contains a server-side request forgery caused by improper validation of destination addresses in API endpoints, letting authenticated users fetch internal Azure platform content, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-87998 PoC publicAuth required
Open WebUI - Broken Access Control
Open WebUI 0.10.0 to 0.11.1 contains a broken access control vulnerability caused by missing administrator checks in DELETE /api/v1/knowledge/{id}/delete, letting non-administrator users with write access delete shared external connections, exploit requires write access to one external knowledge base.
- 7.7 /10 HighCVE-2026-87996 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI 0.9.6 to 0.11.1 contains an SSRF caused by inconsistent hostname validation in SafePlaywrightURLLoader, letting authenticated users with DNS control expose internal service responses, exploit requires authenticated user controlling DNS.
- 8.7 /10 HighCVE-2026-87995 PoC publicAuth required
Open WebUI - Stored XSS
Open WebUI 0.8.11 to 0.11.1 contains a stored XSS caused by rendering terminal port content in an iframe sandbox with allow-scripts and allow-same-origin, letting authenticated users with shared terminal access execute scripts and take over victim accounts, exploit requires victim to open the preview.
- 8.1 /10 HighCVE-2026-87930 PoC publicNo auth
MaxSite CMS - Insecure Deserialization
MaxSite CMS through 109.6 contains an insecure deserialization vulnerability caused by passing the ci_session cookie to unserialize() without class restrictions, letting unauthenticated attackers inject PHP objects and potentially execute code.
- 9.8 /10 CriticalCVE-2026-87929 No auth
MaxSite CMS - Authentication Bypass
MaxSite CMS through 109.6 contains a broken authentication caused by a hardcoded session encryption key in application/config/config.php, letting unauthenticated attackers forge administrator session cookies, exploit requires knowledge of the hardcoded key.
- 8.2 /10 HighCVE-2026-87927 No auth
MaxSite CMS - Local File Inclusion
MaxSite CMS <= 109.6 contains a local file inclusion vulnerability caused by base64-encoded path traversal sequences in ajax and require-maxsite dispatchers, letting unauthenticated attackers execute privileged handler files bypassing path validation.
- 7.3 /10 HighCVE-2026-87922 No auth
Rizwan17 inventory-management-system - Authentication Bypass
Rizwan17 inventory-management-system contains an authentication bypass caused by manipulation of the "userid" argument in DBOperation.addCategory of includes/process.php AJAX Backend, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-87921 No auth
Rizwan17 inventory-management-system - SQL Injection
Rizwan17 inventory-management-system contains a SQL injection caused by manipulation of update_category, cid, update_brand, or update_product arguments in includes/manage.php update_record function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 9.6 /10 CriticalCVE-2026-87911 No auth
Amazon awslabs postgres-mcp-server - Command Injection
Amazon awslabs postgres-mcp-server < 1.1.7 contains an OS command injection caused by improper read-only enforcement in the SQL validation component, letting unauthenticated actors execute OS commands via crafted COPY ... TO PROGRAM statements, exploit requires authenticated user interaction.
- 7.7 /10 HighCVE-2026-87877 No auth
zstd-jni - Use After Free
zstd-jni < 1.5.7-14 contains a use-after-free caused by failure to validate closed state in setDict, setLongMax, setLevel, and setRefMultipleDDicts methods, letting attackers corrupt memory or crash JVM by writing through freed pointers.