Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 163 of 681
- 8.8 /10 HighCVE-2026-102627 Auth required
IBM TRIRIGA Application Platform - Remote Code Execution
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains a remote code execution caused by improper validation of file paths during archive extraction, letting remote authenticated attackers execute arbitrary code.
- 8.1 /10 HighCVE-2025-71432 No auth
Frappe ERPNext - Reflected XSS
Frappe ERPNext < 14.92.1 and 15.x < 15.83.0 contain a reflected cross-site scripting vulnerability caused by missing input validation on a certain page, letting remote attackers execute arbitrary JavaScript in authenticated sessions, exploit requires victim to be logged in and open crafted URL.
- 9.8 /10 CriticalCVE-2025-71429 No auth
GPT-SoVITS - Command Injection
GPT-SoVITS through 20250606v2pro contains a command injection caused by improper sanitization of output folder paths in tools/uvr5/vr.py, letting unauthenticated attackers execute OS commands via UVR5 WebUI output folder inputs.
- 8.8 /10 HighCVE-2024-58390 Auth required
Frappe - Broken Access Control
Frappe < 14.81.4 and 15.x < 15.41.0 contains a broken access control vulnerability caused by improper privilege management in a document action, letting authenticated Website User role attackers escalate to System Manager privileges.
- 8.2 /10 HighCVE-2021-48012 No auth
fast-toml - Prototype Pollution
fast-toml <= 0.5.4 contains a prototype pollution vulnerability caused by parsing TOML with __proto__, constructor, or prototype keys, letting attackers cause denial of service or authorization bypass, exploit requires crafted TOML input.
- 7.5 /10 HighCVE-2021-48011 No auth
Servor - Path Traversal
Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability caused by improper decoding of URL-encoded dot segments in serveStaticFile and serveDirectoryListing, letting unauthenticated remote attackers read arbitrary files and list directories outside the root, exploit requires no authentication.
- 7.5 /10 HighCVE-2020-37280 No auth
cbor-sync - Denial of Service
cbor-sync <= 1.0.4 contains a denial of service caused by trusting declared array and map lengths without validating remaining input in CBOR.decode, letting remote attackers exhaust CPU and memory by crafted payloads.
- 8.1 /10 HighCVE-2020-37279 No auth
easy-pdf-merge - Command Injection
easy-pdf-merge 0.1.0 through 0.2.6 contains a command injection caused by injection of shell metacharacters into source paths, destination path, or maxHeap option, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input with shell metacharacters.
- 8.8 /10 HighCVE-2026-96227 No auth
Piotnet Forms - Stored XSS
Piotnet Forms WordPress plugin through 1.0.30 contains a stored XSS caused by lack of authentication and validation in form-submission file-upload, letting unauthenticated attackers execute arbitrary JavaScript in site's origin, exploit requires no authentication.
- 7.1 /10 HighCVE-2026-91829 No auth
Subscribe to Comments WordPress plugin - Reflected XSS
Subscribe to Comments WordPress plugin < 2.3.3 contains a reflected XSS caused by improper validation of a parameter reflected into a link target, letting unauthenticated attackers execute scripts via crafted URLs, exploit requires victim to click the crafted URL.
- 8.6 /10 HighCVE-2026-89302 No auth
Post Voting System WordPress - SQL Injection
Post Voting System WordPress plugin <= 1.0 contains a SQL injection caused by improper sanitization and escaping of a parameter in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands.
- 8.6 /10 HighCVE-2026-89299 No auth
WP Verify API WordPress plugin - SQL Injection
WP Verify API WordPress plugin through 1.0.0 contains a sql injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers execute arbitrary SQL commands.
- 8.6 /10 HighCVE-2026-89297 No auth
Loja Automática WordPress - SQL Injection
Loja Automática WordPress plugin through 1.0.0 contains a sql injection caused by improper sanitization and escaping of a parameter in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands.
- 8.6 /10 HighCVE-2026-89287 No auth
ASPL Product Quotation WordPress plugin - SQL Injection
ASPL Product Quotation WordPress plugin through 1.1.0 contains a SQL injection caused by unsanitized and unescaped parameters in SQL statements, letting unauthenticated attackers read arbitrary database data, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-89285 No auth
WordPress Datalist - SQL Injection
WordPress Datalist plugin <= 0.0.3 contains a SQL injection caused by unsanitized and unescaped request parameters used in SQL queries, letting unauthenticated attackers read arbitrary database data.