Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 833 of 891
- 7.1 /10 HighCVE-2026-4130 Auth required
NI SystemLink - Information Disclosure
NI SystemLink and NI SystemLink Server <= 2026 Q3 contain a sensitive information disclosure caused by storage of sensitive data in cleartext, letting local attackers obtain sensitive information, exploit requires local access.
- 8.1 /10 HighCVE-2026-4129 Auth required
NI SystemLink - Broken Access Control
NI SystemLink and NI SystemLink Server <= 2026 Q3 contain an improper access control vulnerability caused by insufficient restrictions on host OS files and directories, letting authenticated users with limited privileges access restricted files.
- 9.8 /10 CriticalCVE-2026-38626 No auth
Garlic-Hub - SQL Injection
Garlic-Hub v1.0.1 contains a sql injection caused by improper sanitization in src/Modules/Items/Repositories/ItemsRepository.php, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 7.8 /10 HighCVE-2026-2310 Auth required
IBM webMethods Integration Server - XML External Entity Injection
IBM webMethods Integration Server 11.1 contains an XML external entity injection caused by improper processing of XML data, letting remote attackers expose sensitive information or cause memory resource consumption, exploit requires crafted XML input.
- 9.1 /10 CriticalCVE-2026-19646 No auth
IBM Common Licensing Agent - Open Redirect
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 contain an open redirect caused by improper validation of the HTTP Host header, letting remote attackers redirect users to arbitrary domains, exploit requires crafted HTTP requests.
- 7.7 /10 HighCVE-2026-19584 Auth required
Velociraptor - Server-Side Template Injection
Velociraptor contains a server-side template injection caused by interpolation of notebook cell content without ACL checks during backup restoration, letting users with NOTEBOOK_EDITOR permission execute elevated VQL queries, exploit requires NOTEBOOK_EDITOR permission.
- 9.9 /10 CriticalCVE-2026-19583 Auth required
Velociraptor - Broken Access Control
Velociraptor contains a broken access control vulnerability caused by missing permission checks on client monitoring artifacts, letting users schedule restricted artifacts like Linux.Sys.BashShell, exploit requires scheduling privileges.
- 7.5 /10 HighCVE-2026-19439 No auth
Ultimate Gift Cards for WooCommerce - Broken Access Control
Ultimate Gift Cards for WooCommerce WordPress plugin < 3.2.10 contains a broken access control vulnerability caused by lack of authorization checks when displaying gift card details, letting unauthenticated users disclose customer data and gift card information, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-19436 No auth
Ultimate Gift Cards for WooCommerce - Broken Access Control
Ultimate Gift Cards for WooCommerce WordPress plugin < 3.2.10 contains a broken access control vulnerability caused by lack of reconciliation between gift card coupon value and actual checkout amount, letting unauthenticated users obtain excess store credit, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-19136 No auth
Tianxi AI Agent PC Application - Command Injection
Tianxi AI Agent PC Application contains a command injection caused by handling of specially crafted links, letting local users execute arbitrary operating system commands, exploit requires local user interaction.
- 7.1 /10 HighCVE-2026-18994 Auth required
Lenovo File Manager - Broken Access Control
Lenovo File Manager Android Application contains an improper authorization vulnerability that allows a local authenticated user to read or modify protected files within the application, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-18351 PoC publicNo auth
Elementor Drag and Drop File Upload - Unrestricted File Upload
Elementor Drag and Drop File Upload plugin for WordPress <= 1.6.0 contains an arbitrary file upload vulnerability caused by insufficient file type validation in is_file_type_valid(), letting unauthenticated attackers upload executable files and achieve remote code execution.
- 7.5 /10 HighCVE-2026-15019 No auth
WooCommerce Direct Download - Path Traversal
WooCommerce Direct Download plugin <= 1.19 contains a directory traversal vulnerability caused by insufficient validation in the top-level include function, letting unauthenticated attackers read arbitrary files on the server, exploit requires presence of at least one free, virtual, downloadable product.
- 8.0 /10 HighCVE-2026-14873 Auth required
Bulk Password Reset WordPress plugin - Privilege Escalation
Bulk Password Reset WordPress plugin <= 1.3.3 contains a privilege escalation via account takeover caused by improper user identity validation before updating user details, letting authenticated attackers with subscriber-level access change arbitrary user emails and reset passwords.
- 7.8 /10 HighCVE-2026-11813 Auth required
Lenovo Filez Client - Privilege Escalation
Lenovo Filez Client contains an improper permissions vulnerability that allows local authenticated users to escalate privileges by exploiting incorrect permission settings.