Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 821 of 891

  • 7.1 /10 High
    CVE-2026-88873 No auth

    WWBN AVideo - Cross-Site Request Forgery

    WWBN AVideo contains a cross-site request forgery caused by lack of CSRF token validation in view/logArchive.json.php, letting unauthenticated attackers archive logs and truncate live logs via crafted GET requests, exploit requires administrator interaction.

  • 7.1 /10 High
    CVE-2026-88872 No auth

    AVideo - Cross-Site Request Forgery

    AVideo contains a cross-site request forgery caused by lack of CSRF token validation in setPassword.json.php endpoint, letting unauthenticated attackers modify any user's channel password via crafted GET requests, exploit requires administrator to visit malicious webpage.

  • 7.1 /10 High
    CVE-2026-88870 No auth

    WWBN AVideo - Cross-Site Request Forgery

    WWBN AVideo contains a cross-site request forgery vulnerability caused by missing CSRF token validation in LoginControl plugin PGP key endpoints, letting attackers replace logged-in users' PGP 2FA public keys, exploit requires victim to be logged in.

  • 9.3 /10 Critical
    CVE-2026-88869 No auth

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by improper escaping of the "label" parameter in AD_Server plugin's log.php endpoint, letting unauthenticated attackers execute arbitrary JavaScript in admin browser sessions.

  • 8.7 /10 High
    CVE-2026-88868 Auth required

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by unsanitized title and description fields in the LiveLinks plugin, letting users with canStream permission execute scripts in visitors' browsers, exploit requires canStream permission.

  • 8.7 /10 High
    CVE-2026-88867 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting caused by unsanitized POST parameters 'name' and 'iconClass' in category creation, letting authenticated users with canUpload permission execute JavaScript in other users' browsers, exploit requires usersCanCreateNewCategories enabled.

  • 8.7 /10 High
    CVE-2026-88866 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo contains a stored XSS caused by failure to encode the User-Agent header in the LoginControl plugin, letting attackers with valid accounts execute scripts in administrator browsers via Login History page.

  • 8.1 /10 High
    CVE-2026-88865 Auth required

    AVideo - Broken Access Control

    AVideo contains a broken access control caused by failure to validate restream ownership in getRestream.json.php, letting authenticated users with canStream permission mint tokens for arbitrary restreams and retrieve other users' stream keys.

  • 9.1 /10 Critical
    CVE-2026-88864 Auth required

    Capgo - Broken Access Control

    Capgo contains a broken access control vulnerability caused by unrestricted write access to the public.sso_providers table via Supabase PostgREST, letting attackers with a full API key bypass SSO provisioning controls and enforce arbitrary SSO, exploit requires possession of a full API key.

  • 8.1 /10 High
    CVE-2026-88863 Auth required

    capgo.app capgo - Broken Access Control

    capgo.app npm package capgo through 12.207.1 contains a broken access control vulnerability caused by missing role rank comparison in validateInvite() function, letting authenticated users with org.invite_user permission escalate privileges to org_admin or org_billing_admin, exploit requires authenticated user with org.invite_user permission.

  • 8.8 /10 High
    CVE-2026-88862 Auth required

    Capgo - Broken Access Control

    Capgo backend through 12.242.4 contains a broken access control vulnerability caused by improper validation of parent-child delegation in API key processing, letting authenticated apikey_manager keys escalate privileges by impersonating more privileged sibling keys, exploit requires authenticated apikey_manager API key.

  • 8.3 /10 High
    CVE-2026-88861 PoC publicAuth required

    Capgo - Authentication Bypass

    Capgo contains an authentication bypass caused by improper assurance level validation in Edge JWT middleware and RBAC authorization, letting attackers with only a victim's password perform privileged operations, exploit requires victim's password.

  • 7.5 /10 High
    CVE-2026-88290 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.14 (260903) contains a denial of service caused by unauthenticated clients declaring unbounded VLSVR frame lengths, letting remote attackers exhaust memory and resources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-88289 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.14 (260903) contains a stack buffer overflow caused by improper validation of variable-length fields in VLSVR request handlers, letting unauthenticated remote attackers cause a denial of service by crashing the service.

  • 7.5 /10 High
    CVE-2026-88287 No auth

    GeoVision GV-LPC2211 - Denial of Service

    GeoVision GV-LPC2211 V1.13 contains a buffer overflow caused by unbounded Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, letting remote attackers crash the discovery process.