Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 817 of 891

  • 9.8 /10 Critical
    CVE-2026-62105 No auth

    ThemeREX Addons - Remote Code Execution

    ThemeREX Addons < 2.45.0 contains an unauthenticated PHP Object Injection caused by improper handling of serialized data, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62103 No auth

    Everest Forms - Insecure Deserialization

    Everest Forms <= 3.6.0 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-62102 Auth required

    Gato GraphQL - Privilege Escalation

    Gato GraphQL <= 19.2.3 contains a privilege escalation caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.

  • 7.1 /10 High
    CVE-2026-62089 Auth required

    Pixar Labs Master Addons for Elementor - Broken Access Control

    Pixar Labs Master Addons for Elementor <= 3.2.2 contains a broken access control vulnerability caused by missing authorization checks, letting attackers abuse privileges, exploit requires no special conditions.

  • 7.0 /10 High
    CVE-2026-57842 Auth required

    NetBSD - Use After Free

    NetBSD contains a use-after-free and double-free vulnerability caused by a missing return statement in msg_recv_copyin() within the COMPAT_NETBSD32 layer, letting local users trigger kernel panic or memory corruption by calling recvmsg() with specific msg_iovlen values.

  • 7.4 /10 High
    CVE-2026-54241 No auth

    libde265 - Integer Overflow

    libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in sample adaptive offset input-buffer size calculation, letting attackers cause out-of-bounds heap read or crash the decoder, exploit requires crafted HEVC stream.

  • 7.4 /10 High
    CVE-2026-54240 No auth

    libde265 - Integer Overflow

    libde265 < 1.1.1 contains an integer overflow caused by signed 32-bit arithmetic in pixel offset calculations, letting attackers trigger out-of-bounds heap reads or writes, exploit requires crafted HEVC stream with large image dimensions.

  • 8.3 /10 High
    CVE-2026-54174

    Melange Apko - Package Integrity Bypass

    Melange < 0.50.4 and Apko < 1.2.9 contain a package tampering vulnerability caused by missing verification of data section hash in APK packages, letting attackers substitute arbitrary files via mirror compromise or MITM, exploit requires attacker to control package source.

  • 7.1 /10 High
    CVE-2026-54166 Auth required

    Shelf - Server-Side Request Forgery

    Shelf prior to version 1.20.3 contains a server-side request forgery caused by bypassing imageUrl validation in the Asset CSV Content Import feature, letting authenticated users with asset:import permission make arbitrary server requests, exploit requires authenticated user with asset:import permission.

  • 7.5 /10 High
    CVE-2026-54135 No auth

    AirSane - Denial of Service

    AirSane < 0.4.12 contains a denial of service caused by improper validation of Content-Length header in the custom HTTP server, letting remote unauthenticated attackers crash the service via memory exhaustion.

  • 9.3 /10 Critical
    CVE-2026-54072 No auth

    Authorizer - Open Redirect

    Authorizer prior to 2.2.1 contains an open redirect vulnerability caused by lack of validation of redirect_uri in /authorize endpoint, letting unauthenticated attackers steal tokens via attacker-supplied URLs, exploit requires attacker to obtain client_id from public endpoint.

  • 9.8 /10 Critical
    CVE-2026-53952 No auth

    GetSimple CMS - Authentication Bypass

    GetSimple CMS <= 3.4.0a and GetSimpleCMS-CE <= 3.3.22 contain an authentication bypass caused by a logic flaw in the automated deletion of admin/setup.php, letting unauthenticated attackers create new admin accounts, exploit requires access to setup script post-installation.

  • 9.8 /10 Critical
    CVE-2026-52630 No auth

    Woltlab WCF - SQL Injection

    Woltlab WCF <= 6.2.4 contains a SQL injection caused by improper sanitization in UserEditor.class.php and UserAction.class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted requests.

  • 7.5 /10 High
    CVE-2026-50013 No auth

    Hoverfly - Denial of Service

    Hoverfly < 1.12.8 contains a denial of service caused by unsynchronized concurrent writes to the shared responsesDiff map in Diff mode, letting attackers crash the process by sending multiple simultaneous requests.

  • 7.5 /10 High
    CVE-2026-49846 No auth

    libks - Path Traversal

    libks < 2.0.11 contains a path traversal vulnerability caused by improper URI canonicalization in clean_uri() allowing embedded ".." sequences to bypass checks, letting attackers access arbitrary filesystem paths, exploit requires crafted URI with excessive path segments.