Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 13 of 891

  • 9.4 /10 Critical
    CVE-2026-105603 Auth required

    Joomla Extension DJ-Classifieds - Unrestricted File Upload

    Joomla Extension DJ-Classifieds < 3.11.3 contains an unrestricted file upload vulnerability caused by insufficient validation, letting unprivileged attackers upload arbitrary files leading to remote code execution, exploit requires authentication.

  • 8.6 /10 High
    CVE-2026-105602 Auth required

    Joomla Extension joomshaper.com Helix Ultimate - Stored XSS

    Joomla Extension joomshaper.com Helix Ultimate < 2.2.11 contains a stored cross-site scripting caused by improper sanitization of Mega Menu Badge Text, letting attackers execute scripts in users' browsers, exploit requires user interaction.

  • 8.6 /10 High
    CVE-2026-105600 Auth required

    Joomla Extension php-web-design.com - Remote Code Execution

    Joomla Extension php-web-design.com StageIt 1.0-5.7.5, 6.0-6.3.5 contains a remote code execution caused by setting strings, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-105476 Auth required

    cPanel - Broken Access Control

    cPanel contains a broken access control vulnerability caused by improper link resolution before file access, letting remote authenticated users write arbitrary root-owned files and escalate privileges.

  • 8.7 /10 High
    CVE-2026-105475 No auth

    cPanel - Information Disclosure

    cPanel contains an information disclosure vulnerability caused by improper neutralization of a NUL byte, letting remote attackers read any mail account's calendar and contact data, exploit requires no special privileges.

  • 8.4 /10 High
    CVE-2026-104080 No auth

    Control Web Panel - Command Injection

    Control Web Panel (CWP) < 1.30 contains an OS command injection caused by unvalidated 'user' parameter in /valid_token/ route, letting unauthenticated attackers execute arbitrary commands as root, exploit requires crafted request.

  • 7.2 /10 High
    CVE-2026-103420 No auth

    Joomla Extension php-web-design.com StageIt - Cross Site Request Forgery

    Joomla Extension php-web-design.com StageIt 1.0-5.7.5, 6.0-6.3.5 contains a cross site request forgery caused by lack of proper request validation for various actions, letting attackers perform unauthorized actions, exploit requires victim interaction.

  • 8.6 /10 High
    CVE-2026-103419 Auth required

    Joomla Extension joomshaper.com Helix Ultimate - Stored XSS

    Joomla Extension joomshaper.com Helix Ultimate < 2.2.11 contains a stored cross-site scripting caused by improper input sanitization in Media Picker, letting attackers execute scripts in users' browsers, exploit requires no special conditions.

  • 8.9 /10 High
    CVE-2026-102802

    Joomla Extension regularlabs.com - Command Injection

    Joomla Extension regularlabs.com Sourcerer < 17.0.1 used with Articles Anywhere < 20.1.1 contains a PHP code injection caused by improper trust evaluation in article inclusion, letting attackers execute PHP code with elevated article-author privileges, exploit requires specific extension combination and configuration.

  • 9.8 /10 Critical
    CVE-2026-102435 No auth

    Ultra Addons for Contact Form 7 - Arbitrary File Deletion

    Ultra Addons for Contact Form 7 <= 3.5.54 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in _getObjAttr function, letting unauthenticated attackers delete files remotely, exploit requires PDF Generator add-on active and CF7 form configured.

  • 7.5 /10 High
    CVE-2026-101186 No auth

    window module - Denial of Service

    window module contains a denial of service vulnerability caused by unspecified issue, letting attackers affect system availability, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-101176

    Unknown Product - Broken Access Control

    An unspecified product contains a broken access control vulnerability in the event notification management module, letting attackers affect service confidentiality, exploit requires unspecified conditions.

  • 9.4 /10 Critical
    CVE-2025-11969 No auth

    WSO2 API Manager - Broken Access Control

    WSO2 API Manager contains a broken access control vulnerability caused by improper enforcement of access control mechanisms in System REST APIs, letting users with lower privileges perform unauthorized administrative actions, exploit requires access to System REST APIs.

  • 7.6 /10 High
    CVE-2026-95863 No auth

    Apache Wicket - Stored XSS

    Apache Wicket 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 contain a stored XSS caused by improper escaping of component and markup IDs in JavaScript contexts, letting attackers execute script in the application's origin, exploit requires attacker-controlled component or markup IDs.

  • 7.4 /10 High
    CVE-2026-84231 No auth

    Apache Wicket - Stored XSS

    Apache Wicket 8.0.0 through 8.19.0 contains a stored XSS caused by improper escaping of URLs in ExternalLink component's JavaScript click handler, letting attackers execute script when users activate the element.