Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 9 of 891

  • 7.1 /10 High
    CVE-2026-120429 Auth required

    Camaleon CMS - Broken Access Control

    Camaleon CMS < 2.9.2 contains a broken access control vulnerability in Admin::MediaController, letting low-privileged authenticated users bypass role-based Media permissions to upload files, read private media, and modify avatars.

  • 7.5 /10 High
    CVE-2026-120426 No auth

    OpenCSG CSGHub - Authorization Bypass

    OpenCSG CSGHub <= 2.6.0-ce contains an authorization bypass caused by injection of a percent-encoded current_user parameter in the unauthenticated file resolve route, letting remote attackers read private repository files, exploit requires crafted file path with injected parameter.

  • 7.3 /10 High
    CVE-2026-120349 No auth

    dayrui XunRuiCMS - Code Injection

    dayrui XunRuiCMS <= 4.7.4 contains a code injection caused by manipulation of the "dirname" argument in /var/www/html/zzmob/index.php Mobile Site Directory, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-120348 No auth

    dayrui XunRuiCMS - Code Injection

    dayrui XunRuiCMS <= 4.7.4 contains a code injection caused by manipulation in _get_tpl_content function of Email Template Rendering component, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 7.3 /10 High
    CVE-2026-120347 No auth

    dayrui XunRuiCMS - SQL Injection

    dayrui XunRuiCMS <= 4.7.4 contains a SQL injection caused by manipulation of the "catid" argument in Member Module's View function, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 10.0 /10 Critical
    CVE-2026-120345 No auth

    WAVLINK WN551X3-A - Command Injection

    WAVLINK WN551X3-A M51X3_V251020-WO-182e965 contains a command injection caused by manipulation of the "data" argument in /bin/ioos DNS Resolution Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-120344 No auth

    WAVLINK WN551X3-A - Command Injection

    WAVLINK WN551X3-A M51X3_V251020-WO-182e965 contains a command injection caused by manipulation of the "group_name" argument in /bin/ioos WireGuard CLI Group Handler, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 7.3 /10 High
    CVE-2026-120342 No auth

    mathurvishal CloudClassroom-PHP-Project - SQL Injection

    mathurvishal CloudClassroom-PHP-Project contains a sql injection caused by manipulation of "eid" argument in viewquery.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-120341 No auth

    mathurvishal CloudClassroom-PHP-Project - Open Redirect

    mathurvishal CloudClassroom-PHP-Project contains an open redirect vulnerability caused by manipulation in studentdetails.php, letting remote attackers execute code after redirect, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-120337 No auth

    VStarcam O-KAM SuperIPCam - Use After Free

    VStarcam O-KAM SuperIPCam 1.3.3.32 contains a use after free vulnerability caused by manipulation in P2P Session Teardown function FUN_005a2d44, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-120336 No auth

    VStarcam O-KAM Client - Buffer Overflow

    VStarcam O-KAM Client 1.3.3.32 contains a stack-based buffer overflow caused by improper handling in function FUN_10003EA0 in DevDll_925.dll, letting remote attackers execute arbitrary code, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-120324 No auth

    Aklivity Zilla - Path Traversal

    Aklivity Zilla <= 1.3.4/2.4.7/2.5.0-rc2 contains a path traversal caused by manipulation of the "params" argument in Path.resolve function of FileSystemServerFactory in http-filesystem Binding, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-120322 Auth required

    Termix-SSH Termix - Path Traversal

    Termix-SSH Termix <= 2.9.2 contains a path traversal caused by manipulation of the "destPath" argument in /plugin-api/file-manager/transferToHost, letting remote attackers access arbitrary file paths, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-120318 Auth required

    Product Gallery Slider & Additional Variation Images for WooCommerce - Broken Access Control

    Product Gallery Slider & Additional Variation Images for WooCommerce < 2.3.26 contains a broken access control caused by missing authorization in Codestar backup AJAX actions, letting shop managers read, overwrite, or delete WordPress options including wp_user_roles to escalate privileges, exploit requires shop manager privileges.

  • 8.8 /10 High
    CVE-2026-120315 Auth required

    LobeHub Chat - Path Traversal

    LobeHub Chat 1.84.26 < 2.1.49 contains a path traversal caused by unsanitized file names in writeTempFile(), letting authenticated users write arbitrary files and execute code or cause denial of service.