Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 168 of 681
- 7.0 /10 HighCVE-2026-108693
ImageMagick - Command Injection
ImageMagick on Windows <= 7.1.2-33 and <= 6.9.13-58 contains a command injection caused by uncontrolled search path in NTGhostscriptEXE() launching gswin64c.exe by bare name when Ghostscript is unregistered, letting attackers execute code with ImageMagick privileges, exploit requires attacker to place malicious executable in working directory.
- 10.0 /10 CriticalCVE-2026-108576 No auth
TOZED X300 - Command Injection
TOZED X300 <= 6.01.3 contains a command injection caused by manipulation of the "Host" argument in IPPingDiagnostics Handler's process_ping function, letting remote attackers execute OS commands remotely, exploit requires network access.
- 7.3 /10 HighCVE-2026-108571 No auth
Xinhu Rainrock RockOA - SQL Injection
Xinhu Rainrock RockOA <= 2.7.6 contains a sql injection caused by manipulation of the "ID" argument in kqjcmdModel::returnchuli function of Openkqj Action, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 9.9 /10 CriticalCVE-2026-108540 Auth required
OpenSpug Spug - Command Injection
OpenSpug Spug <= 3.4.0/4.0.1 contains a command injection caused by manipulation in /exec/transfer file transfer component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 8.3 /10 HighCVE-2026-108522 No auth
Studio-Saelix Sencho - Authentication Bypass
Studio-Saelix Sencho <= 0.94.1 contains an authentication bypass caused by manipulation of the X-Forwarded-For header in the Login Endpoint /api/auth/login, letting remote attackers bypass authentication, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-106029 No auth
WeddingCity Lite WordPress - Broken Access Control
WeddingCity Lite WordPress plugin through 1.0.4 contains a broken access control vulnerability caused by lack of authorization checks before deleting posts, pages, and media, letting unauthenticated attackers delete arbitrary content site-wide.
- 7.2 /10 HighCVE-2026-104680 Auth required
Envira Gallery WordPress plugin - Broken Access Control
Envira Gallery WordPress plugin < 1.16.2 contains a broken access control vulnerability caused by improper capability verification during setup-wizard installation requests, letting Multisite subsite Administrators install arbitrary plugins reserved for Super Admins.
- 9.8 /10 CriticalCVE-2026-104028 No auth
Anton Extensions WordPress - Unrestricted File Upload
Anton Extensions WordPress plugin through 1.2.2 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution.
- 8.6 /10 HighCVE-2026-103695 No auth
Mobile builder WordPress - SQL Injection
Mobile builder WordPress plugin <= 1.4.2 contains a SQL injection caused by unsanitized and unescaped parameter usage in SQL statements, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-103694 Auth required
Mobile builder WordPress plugin - Broken Access Control
Mobile builder WordPress plugin through 1.4.2 contains a broken access control vulnerability caused by improper restriction of user meta key updates via REST routes, letting logged-in users escalate privileges to administrator, exploit requires user to be logged in.
- 8.8 /10 HighCVE-2026-103305 No auth
Prenotazioni WordPress - Stored XSS
Prenotazioni WordPress plugin through 1.7.5 contains a stored cross-site scripting caused by lack of authorization and CSRF checks when saving settings and improper escaping, letting unauthenticated attackers execute scripts against administrators and visitors, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-97670 CISA KEVNo auth
Avada (Fusion) Builder - Authorization Bypass
Avada (Fusion) Builder plugin for WordPress <= 7.16.1 contains an authorization bypass caused by improper verification of attacker-supplied action hook names in form submissions, letting unauthenticated attackers invoke arbitrary WordPress action hooks causing state changes including permanent content deletion, exploit requires a published Avada form with AJAX submission and specific notification email_message template.
- 7.1 /10 HighCVE-2026-97264 No auth
Greg Winiarski WPAdverts - Reflected XSS
Greg Winiarski WPAdverts <= 2.3.4 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts via crafted input, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-97263 No auth
Greg Winiarski WPAdverts - Stored XSS
Greg Winiarski WPAdverts <= 2.3.4 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-96840 No auth
Post Grid Gutenberg Blocks – PostX - Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX plugin for WordPress <= 5.1.0 contains a stored cross-site scripting caused by insufficient sanitization of display_name user field, letting unauthenticated attackers inject scripts executed when users access injected pages.