Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 16 of 891
- 7.6 /10 HighCVE-2026-111089
Apache Wicket - Stored XSS
Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain a stored XSS caused by unescaped texts in JavaScript string literals and attribute values in resource bundles, letting attackers inject script in the application's origin, exploit requires attacker-controlled resource bundle entries.
- 9.1 /10 CriticalCVE-2026-89270 No auth
Popup Builder - Authorization Bypass
Popup Builder WordPress plugin <= 4.4.5 contains an authorization bypass caused by improper user authorization verification and flawed SGPopup::find() logic, letting unauthenticated attackers trash all published popups via crafted GET requests.
- 8.8 /10 HighCVE-2026-76010 Auth required
NextGEN Gallery - Remote Code Execution
NextGEN Gallery WordPress plugin <= 4.4.1 contains a remote code execution caused by unrestricted mass assignment and missing realpath containment in render_image, letting authenticated attackers with custom-level access execute code on the server, exploit requires attacker to own at least one NextGEN gallery.
- 9.8 /10 CriticalCVE-2026-120209 No auth
AJ-Report - Remote Code Execution
AJ-Report through 1.7.1 contains a remote code execution caused by hard-coded JWT secret allowing attackers to forge share tokens and execute scripts via testTransform endpoint, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-120208 No auth
libheif - Buffer Overflow
libheif < 1.23.3 contains a heap-based buffer overflow caused by unequal bit depths in chroma components in unc_decoder_mixed_interleave::processTile(), letting attackers execute code via crafted HEIF files, exploit requires crafted file input.
- 7.1 /10 HighCVE-2026-120207 No auth
Thelia Page Module - Cross-Site Request Forgery
Thelia Page Module < 2.0.4 contains a cross-site request forgery caused by missing CSRF tokens and permission checks in back-office delete routes, letting remote attackers delete page tags, documents, and images by tricking logged-in administrators.
- 8.0 /10 HighCVE-2026-120205 No auth
Thelia - Stored XSS
Thelia < 3.1.0 contains a stored XSS caused by unescaped customer names in ForSomeCustomers::getSummary(), letting unauthenticated attackers inject scripts that execute when admins view coupons, exploit requires attacker registration with script payload.
- 8.8 /10 HighCVE-2026-120203 Auth required
ShowDoc - Command Injection
ShowDoc 2.8.14 before 3.9.6 contains a command injection caused by eval() execution of mockjs templates in Mock feature, letting authenticated users execute shell commands as root, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-120201 No auth
Jpom - Authentication Bypass
Jpom 2.10.0 through 2.11.12 contains an authentication bypass caused by injection of query conditions into the JPOM-USER-TOKEN header, letting unauthenticated attackers gain super-administrator access and execute commands, exploit requires crafted header injection.
- 7.5 /10 HighCVE-2026-120194
json-glib - Denial of Service
json-glib contains a denial of service caused by infinite loop in JSONPath slice evaluator with negative step, letting attackers force applications evaluating attacker-controlled JSONPath expressions to hang, exploit requires attacker-controlled JSONPath input.
- 8.2 /10 HighCVE-2026-120135 No auth
Apache Thrift - Denial of Service
Apache Thrift Java bindings < 0.24.0 contain an uncontrolled recursion vulnerability caused by improper recursion handling, letting attackers cause denial of service via resource exhaustion, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-120114 No auth
Debug Log Manager WordPress Plugin - Stored XSS
Debug Log Manager WordPress plugin <= 2.5.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'message' and 'pageUrl' parameters, letting unauthenticated attackers inject scripts executing on user access, exploit requires debug logging enabled with JS error logging and attacker obtaining dlmVars.jsErrorLogging nonce.
- 7.2 /10 HighCVE-2026-120075 No auth
WP Activity Log - Stored XSS
WP Activity Log plugin for WordPress <= 5.6.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.
- 8.8 /10 HighCVE-2026-120070 Auth required
User Frontend - Privilege Escalation
User Frontend WordPress plugin <= 4.3.13 contains a privilege escalation caused by improper sanitization of post_content in submit_post(), letting authenticated subscribers inject editor role shortcode to create privileged accounts, exploit requires subscriber-level access.
- 7.5 /10 HighCVE-2026-120040 Auth required
WordPress Mail logging & Catcher - Sensitive Information Exposure & Privilege Escalation
Mail logging & Catcher plugin for WordPress <= 2.2.0 contains a sensitive information exposure caused by improper access control on the 'message' parameter, letting authenticated subscribers extract admin password-reset keys and escalate privileges, exploit requires plugin default_view_role misconfiguration.