Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 810 of 891
- 9.8 /10 CriticalCVE-2026-89010 No auth
WAVLINK WN535M1 & WN535M3 - Command Injection
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated command injection caused by unsanitized filename input in sync_server daemon on TCP port 13136, letting remote attackers execute arbitrary root commands.
- 9.1 /10 CriticalCVE-2026-89009 No auth
WAVLINK WN535M - Arbitrary File Write
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability caused by lack of path canonicalization in sync_server daemon on TCP port 13136, letting remote attackers overwrite files as root, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87908 No auth
multiparty - Denial of Service
multiparty 2.1.0 < 4.3.1 contains a denial of service caused by unbounded memory usage while accumulating multipart part headers, letting unauthenticated attackers crash the server by sending large header volumes, exploit requires crafted request.
- 9.8 /10 CriticalCVE-2026-8778 No auth
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields - Unrestricted File Upload
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress <= 1.2.1 contains an unrestricted file upload vulnerability caused by missing file type validation in the mipl_wc_upload_file function, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-87776 No auth
compression Node.js - Denial of Service
compression Node.js middleware < 1.8.2 contains a denial of service caused by unreleased zlib streams on client connection abort, letting remote unauthenticated attackers exhaust memory and crash the server, exploit requires repeated early disconnects.
- 8.1 /10 HighCVE-2026-87020 Auth required
Orthanc DICOM Server - Integer Overflow
Orthanc DICOM Server contains an integer overflow caused by improper pitch and buffer-size computation during PNG decoding, letting attackers cause heap out-of-bounds write, exploit requires crafted PNG input.
- 9.8 /10 CriticalCVE-2026-86793 No auth
SGLang - Insecure Deserialization
SGLang contains an insecure deserialization vulnerability caused by unauthenticated pickle deserialization via /update_weights_from_tensor when no auth keys are configured, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication keys configured.
- 8.8 /10 HighCVE-2026-85677 No auth
Gutenverse News WordPress - Stored XSS
Gutenverse News WordPress plugin < 3.3.3 contains a stored XSS caused by improper restriction of extra HTML in sanitisation contexts, letting unauthenticated users execute JavaScript in admin and visitor browsers, exploit requires unauthenticated comment submission.
- 9.8 /10 CriticalCVE-2026-84390
Fortinet FortiMonitorOnSight - Information Disclosure
Fortinet FortiMonitorOnSight 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7 contain an information disclosure caused by inclusion of sensitive information in source code, letting attackers access sensitive data, exploit requires unspecified attack vector.
- 7.8 /10 HighCVE-2026-8303 Auth required
TUBITAK BILGEM Pardus-software - Privilege Escalation
TUBITAK BILGEM Pardus-software < 1.0.5 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
- 7.8 /10 HighCVE-2026-8301 Auth required
TUBITAK BILGEM Pardus Boot Repair - OS Command Injection
TUBITAK BILGEM Pardus Boot Repair < 1.0.8 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-82617 No auth
Apache OpenNLP - Denial of Service
Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 contain a denial of service caused by ambiguous nested quantifiers in built-in RegexNameFinder patterns for EMAIL and URL, letting attackers supply crafted text to cause excessive CPU usage or thread crashes, exploit requires attacker to supply untrusted text for analysis.
- 8.3 /10 HighCVE-2026-82583 Auth required
NextGen Connect (Mirth Connect) - SQL Injection
NextGen Connect (Mirth Connect) <= 4.7.1 contains a SQL injection caused by improper sanitization in Database Connector API, letting authenticated users execute arbitrary SQL, leading to credential disclosure, file write, and DoS.
- 7.5 /10 HighCVE-2026-82578
XML Batch Processing - XML External Entity Injection
An XML batch processing component with XPath option enabled contains an XML External Entity (XXE) injection caused by lack of entity restrictions in default XPath/JAXP setup, letting attackers exfiltrate data and cause denial of service, exploit requires XML batch processing with XPath enabled.
- 7.1 /10 HighCVE-2026-81907 No auth
Concrete CMS - Cross-Site Request Forgery
Concrete CMS <= 9.5.2 contains a cross-site request forgery caused by lack of enforcement of CSRF token validation in the Express "Clear Entries" function, letting remote attackers force authenticated administrators to delete entries, exploit requires victim admin to visit attacker-controlled page.