Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 15 of 677

  • 9.3 /10 Critical
    CVE-2026-109698 No auth

    Kitae Park Mang Board WP - SQL Injection

    Kitae Park Mang Board WP <= 2.4.4 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-109695 No auth

    WPManageNinja FluentCart - Information Disclosure

    WPManageNinja FluentCart <= 1.7.1 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-109694 No auth

    WP ManageNinja LLC Fluent CRM - Broken Access Control

    WP ManageNinja LLC Fluent CRM <= 3.2.5 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires attacker to have initial access.

  • 8.8 /10 High
    CVE-2026-109693 Auth required

    WP ManageNinja LLC Fluent CRM - Broken Access Control

    WP ManageNinja LLC Fluent CRM <= 3.2.5 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires attacker to have initial access.

  • 7.1 /10 High
    CVE-2026-109692 Auth required

    ThemeGrill User Registration - Broken Access Control

    ThemeGrill User Registration <= 5.2.8 contains an incorrect access control vulnerability caused by missing authorization checks, letting attackers exploit access control weaknesses, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-109688 No auth

    Link Whisper INC Link Whisper Free - SQL Injection

    Link Whisper INC Link Whisper Free <= 0.9.7 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-109686 No auth

    Link Whisper INC Link Whisper Free - Insecure Deserialization

    Link Whisper INC Link Whisper Free <= 0.9.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-109685 No auth

    Link Whisper INC Link Whisper Free - Reflected XSS

    Link Whisper INC Link Whisper Free <= 0.9.7 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-109430 No auth

    Ellucian WebAdvisor - XML External Entity Injection

    Ellucian WebAdvisor 3.2 contains an XML External Entity (XXE) injection caused by enabled external entity and DTD resolution in /WebAdvisor/WebAdvisor endpoint, letting remote attackers perform SSRF, disclose NTLMv2 hashes, and read arbitrary files, exploit requires crafted XML POST requests.

  • 8.7 /10 High
    CVE-2026-109413 No auth

    Symfony YAML - Denial of Service

    Symfony YAML < 5.4.54, 6.4.45, 7.4.18, and 8.1.6 contains a denial of service caused by unbounded recursion in lexInlineStructure() when parsing deeply nested inline collections, letting unauthenticated attackers crash the process via crafted YAML payloads, exploit requires sending a YAML content type request.

  • 9.8 /10 Critical
    CVE-2026-109145 No auth

    User Rights Access Manager WordPress - Broken Access Control

    User Rights Access Manager WordPress plugin through 1.1.3 contains a broken access control caused by unrestricted access to an AJAX account-registration handler, letting unauthenticated attackers register administrator-equivalent accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-108587 No auth

    10Web Booster - Unrestricted File Upload

    10Web Booster WordPress plugin <= 2.34.10 contains an unrestricted file upload vulnerability caused by missing file type validation and leaked REST nonce, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires obtaining a world-readable REST nonce.

  • 7.1 /10 High
    CVE-2026-108498 No auth

    bannersky BSK PDF Manager - Stored XSS

    bannersky BSK PDF Manager <= 3.8.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on other users, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-108497 No auth

    TMS Amelia ameliabooking - SQL Injection

    TMS Amelia ameliabooking <= 2.4.10 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-108491 No auth

    Everest Forms Everest Forms - Stored XSS

    Everest Forms Everest Forms <= 3.6.1 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.