Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 14 of 677

  • 7.2 /10 High
    CVE-2026-18548 No auth

    Groundhogg CRM, Newsletters, and Marketing Automation - Stored XSS

    Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress <= 4.5.14 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'ref' parameter, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.

  • 8.1 /10 High
    CVE-2026-17031 Auth required

    Checkout Field Manager for WooCommerce - Authorization Bypass

    Checkout Field Manager for WooCommerce plugin for WordPress <= 7.9.6 contains an authorization bypass caused by improper user authorization verification, letting authenticated attackers with subscriber-level access delete arbitrary Media Library attachments.

  • 9.4 /10 Critical
    CVE-2026-16438 Auth required

    Mitsubishi Electric GENESIS64 - Incorrect Privilege Assignment

    Mitsubishi Electric GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 (all versions or <= 10.97.3) contain an incorrect privilege assignment caused by default DCOM permissions granted to administrator accounts, letting logged-in administrators locally or remotely launch and operate DCOM objects without UAC elevation, exploit requires attacker to log in with administrator account.

  • 7.1 /10 High
    CVE-2026-16437 Auth required

    Mitsubishi Electric GENESIS - Broken Authentication

    Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz (various versions) contain a weak password recovery mechanism caused by tampering with the management file storing the challenge response, letting authenticated local administrators disclose, tamper, or cause denial of service, exploit requires administrative privileges.

  • 9.2 /10 Critical
    CVE-2026-16436 No auth

    Mitsubishi Electric GENESIS - Authentication Bypass

    Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz (various versions) contain a weak password recovery mechanism caused by a fixed, common challenge response, letting remote attackers unlock the system, exploit requires obtaining the challenge response.

  • 7.5 /10 High
    CVE-2026-15090 No auth

    Link Library WordPress plugin - SQL Injection

    Link Library WordPress plugin <= 7.9.2 contains a time-based SQL injection caused by insufficient escaping of the 'link_url' parameter, letting unauthenticated attackers extract sensitive database information remotely, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2026-110957 No auth

    Wavlink WL-WN530BE2-A - OS Command Injection

    Wavlink WL-WN530BE2-A <= M30BE2_V250604 contains an OS command injection caused by improper handling of the REMOTE_ADDR argument in api.cgi login processing, letting remote attackers execute arbitrary commands, exploit requires remote access.

  • 7.1 /10 High
    CVE-2026-110912 PoC publicNo auth

    DragonFly BSD - Information Disclosure

    DragonFly BSD <= 6.4.2 before 4bb22ff contains an out-of-bounds read caused by improper validation of hardware and protocol address lengths in ARP input handlers, letting unauthenticated adjacent network attackers disclose kernel memory via crafted ARP requests.

  • 9.8 /10 Critical
    CVE-2026-110911 No auth

    Wheels - SQL Injection

    Wheels 1.1.8 through 4.1.1 contains a SQL injection caused by improper parsing of caller-supplied quoted values in dynamic finders and query builder methods, letting attackers access unauthorized data, exploit requires passing crafted input to vulnerable APIs.

  • 8.8 /10 High
    CVE-2026-110908 Auth required

    Netgate pfSense FRR - Command Injection

    Netgate pfSense FRR package 2.0.2_1 and source revision 2.1.2_1 contain a command injection caused by improper sanitization of filter input in the FRR status filter, letting authenticated WebGUI users with page-status-frr privilege execute commands as root, exploit requires authenticated user with specific privilege.

  • 7.5 /10 High
    CVE-2026-110907 No auth

    Backdrop CMS Core - Broken Access Control

    Backdrop CMS Core 1.35.x < 1.35.2 and 1.34.x < 1.34.6 contain an information disclosure vulnerability caused by insufficient access control on token types in the token browser, letting attackers access restricted token types, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-110723 No auth

    api-gateway - Broken Access Control

    api-gateway <= 1.7.3 contains a broken access control caused by unvalidated use of the leftmost element of X-Forwarded-For header in ClientIpKeyResolver, letting attackers bypass request-rate limiting, exploit requires attacker to control X-Forwarded-For header.

  • 9.8 /10 Critical
    CVE-2026-109892 No auth

    Frontend Admin by DynamiApps - Broken Access Control

    Frontend Admin by DynamiApps <= 3.29.13 contains a broken access control vulnerability caused by incorrect privilege assignment in acf-frontend-form-element, letting attackers escalate privileges, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-109855 No auth

    undici - Denial of Service

    undici 8.11.0 and 8.11.1 contain a denial of service caused by mishandling failed WebSocket handshake over HTTP/2 in the experimental WebSocket client, letting remote unauthenticated servers crash clients, exploit requires opening WebSocket over HTTP/2.

  • 7.1 /10 High
    CVE-2026-109702 No auth

    maxfoundry Social Share Buttons - Stored XSS

    maxfoundry Social Share Buttons <= 1.31 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires crafted input.