Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 164 of 681

  • 8.6 /10 High
    CVE-2026-89283 No auth

    WP Posts Password Batch Manager - Broken Access Control

    WP Posts Password Batch Manager WordPress plugin through 1.1 contains a broken access control caused by lack of capability and nonce checks on bulk post-password actions, letting unauthenticated attackers reset or overwrite passwords of all published posts, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89234 No auth

    WP-Partner WordPress plugin - SQL Injection

    WP-Partner WordPress plugin through 1.2.1 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89232 No auth

    Recordbrowser WordPress plugin - SQL Injection

    Recordbrowser WordPress plugin through 1.1.7 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL queries, letting unauthenticated attackers extract sensitive database information.

  • 8.6 /10 High
    CVE-2026-89214 No auth

    WpCues Basic Quiz WordPress plugin - SQL Injection

    WpCues Basic Quiz WordPress plugin <= 1.6.5 contains a SQL injection caused by improper sanitization and escaping of values in SQL statements, letting unauthenticated attackers read database data, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89213 No auth

    Llavero.io WordPress - SQL Injection

    Llavero.io WordPress plugin <= 0.1.4 contains a SQL injection caused by improper sanitization and escaping of a parameter in SQL statements, letting unauthenticated attackers read database data remotely, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-89195 No auth

    Site Setup Wizard WordPress - SQL Injection

    Site Setup Wizard WordPress plugin <= 1.5.8 contains a SQL injection caused by improper sanitization and escaping of a parameter in SQL statements, letting unauthenticated attackers read database data.

  • 8.6 /10 High
    CVE-2026-88930 No auth

    Social Web Suite WordPress plugin - SQL Injection

    Social Web Suite WordPress plugin through 4.1.12 contains an SQL injection caused by lack of shared secret validation and unsanitized parameter usage in SQL statements, letting unauthenticated users execute arbitrary SQL queries.

  • 8.8 /10 High
    CVE-2026-88905 No auth

    KeyWord Collector WordPress - Stored XSS

    KeyWord Collector WordPress plugin through 1.4 contains a stored XSS caused by lack of authorization and nonce checks when saving settings, letting unauthenticated attackers execute malicious JavaScript via admin settings page or frontend output, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-88903 No auth

    Topcontent WordPress plugin - Stored XSS

    Topcontent WordPress plugin through 1.2.1 contains a stored XSS caused by improper authorization and disabled HTML sanitisation in a request handler, letting unauthenticated attackers publish malicious JavaScript posts, exploit requires no API key configuration.

  • 8.8 /10 High
    CVE-2026-88827 Auth required

    Disable Users WordPress - Broken Access Control

    Disable Users WordPress plugin through 1.0.5 contains a broken access control vulnerability caused by incomplete enforcement of account-disabling on all authentication paths, letting disabled users authenticate with full privileges.

  • 8.8 /10 High
    CVE-2026-88826 No auth

    SmugMug Embed WordPress - Stored XSS

    SmugMug Embed WordPress plugin through 3.13 contains a stored XSS caused by lack of authorization and CSRF checks on an AJAX action that stores unsanitized gallery data, letting unauthenticated attackers execute scripts when admins view settings.

  • 8.8 /10 High
    CVE-2026-87764 No auth

    BuddyPress Instant Chat - Stored XSS

    BuddyPress Instant Chat WordPress plugin <= 1.6 contains a stored XSS caused by lack of sender verification and improper escaping of message content, letting unauthenticated attackers execute scripts in other users' sessions, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-87762 No auth

    Adwised Web Push Notification - Stored XSS

    Adwised Web Push Notification WordPress plugin through 2.5.7 contains a stored XSS caused by missing authorization checks and bypassable secret comparison when the secret key is unset, letting unauthenticated users execute arbitrary JavaScript in visitors' browsers.

  • 8.0 /10 High
    CVE-2026-87761 Auth required

    Adwised Web Push Notification - Stored XSS

    Adwised Web Push Notification WordPress plugin through 2.5.7 contains a stored cross-site scripting caused by lack of capability and nonce checks and unescaped configuration values in inline scripts, letting authenticated users execute scripts on visitors including admins.

  • 8.8 /10 High
    CVE-2026-87760 No auth

    Web Vitals Tracking WordPress - Stored XSS

    Web Vitals Tracking WordPress plugin through 5.4.2 contains a stored cross-site scripting caused by lack of validation and escaping of performance measurements submitted by unauthenticated visitors, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.