Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 165 of 681

  • 8.8 /10 High
    CVE-2026-86798 No auth

    HootBoard WordPress plugin - Stored XSS

    HootBoard WordPress plugin through 3.1.4 contains a stored XSS vulnerability caused by lack of authorization checks and escaping on some REST endpoints, letting unauthenticated attackers execute arbitrary scripts in visitors' browsers.

  • 9.1 /10 Critical
    CVE-2026-86717 No auth

    Insurify WordPress plugin - Broken Access Control

    Insurify WordPress plugin through 1.0 contains a broken access control caused by missing authorization and nonce checks on an AJAX action, letting unauthenticated attackers delete arbitrary WordPress options, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-86706 No auth

    Quick quotes WordPress plugin - Broken Access Control

    Quick quotes WordPress plugin through 1.0.0 contains a broken access control vulnerability caused by lack of capability or nonce checks in an AJAX action, letting unauthenticated attackers alter site settings and cause denial of service.

  • 7.2 /10 High
    CVE-2026-85126 Auth required

    Crowdfundly WordPress plugin - Broken Access Control

    Crowdfundly WordPress plugin through 2.2.2 contains a broken access control vulnerability caused by missing capability checks on some AJAX actions, letting low privileged users escalate to administrator role, exploit requires user with low privileged role.

  • 9.1 /10 Critical
    CVE-2026-85121 No auth

    Insurify WordPress plugin - Broken Access Control

    Insurify WordPress plugin through 1.0 contains a broken access control vulnerability caused by missing authorization and nonce checks in an AJAX action, letting unauthenticated attackers overwrite arbitrary WordPress options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-85118 No auth

    AI Content Generator Marketing WordPress - Broken Access Control

    AI Content Generator Marketing WordPress plugin through 1.0.0 contains a broken access control caused by missing nonce or capability checks on AJAX actions, letting unauthenticated attackers update and delete arbitrary WordPress options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84737 No auth

    Freeton WP WordPress plugin - Authentication Bypass

    Freeton WP WordPress plugin through 1.0.0 contains an authentication bypass caused by improper validation of activation codes, letting unauthenticated attackers log in as any user with a known email address.

  • 9.8 /10 Critical
    CVE-2026-84734 No auth

    Mindstien Quick Login WordPress plugin - Authentication Bypass

    Mindstien Quick Login WordPress plugin through 1.0 contains a broken authentication caused by improper validation of request values against visitor sessions, letting unauthenticated attackers obtain administrator sessions, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-84261 No auth

    Click5 CRM - Stored XSS

    Click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-84260 No auth

    click5 CRM - Stored XSS

    click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-84259 No auth

    click5 CRM WPForms - Stored XSS

    click5 CRM add-on to WPForms WordPress plugin through 1.0.3 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-84258 No auth

    click5 CRM Ninja Forms - Stored XSS

    click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 contains a stored XSS caused by unsanitized and unescaped content submitted through an unauthenticated endpoint, letting unauthenticated attackers execute scripts in admin pages, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84254 No auth

    Click5 CRM add-on to Contact Form 7 WordPress plugin - Broken Access Control

    Click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 contains a broken access control and CSRF vulnerability caused by missing authorization and CSRF checks in REST endpoint, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84253 No auth

    click5 CRM add-on to Gravity Forms - Broken Access Control

    click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 contains a broken access control and CSRF vulnerability caused by lack of authorization and CSRF checks in REST endpoint option updates, letting unauthenticated attackers create admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84252 No auth

    click5 CRM add-on to WPForms - Broken Access Control

    click5 CRM add-on to WPForms WordPress plugin through 1.0.3 contains a broken access control and CSRF vulnerability caused by lack of authorization and CSRF checks in REST endpoint for updating options, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.