Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 169 of 681

  • 7.2 /10 High
    CVE-2026-96765 No auth

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) - Stored Cross-Site Scripting

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'id_token' parameter, letting unauthenticated attackers inject scripts executed when an admin visits the WPO365 wizard page, exploit requires admin to visit the wizard page.

  • 7.2 /10 High
    CVE-2026-96682 No auth

    Presto Player - Stored Cross-Site Scripting

    Presto Player WordPress plugin <= 4.5.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in <presto-player> tag, letting unauthenticated attackers inject scripts executed by users, exploit requires initial comment approval.

  • 7.2 /10 High
    CVE-2026-96667 No auth

    The Real Estate Manager – Property Listing and Agent Management - Stored XSS

    The Real Estate Manager – Property Listing and Agent Management WordPress plugin <= 7.3 contains a stored cross-site scripting caused by insufficient sanitization and escaping of the 'first_name' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-96662 No auth

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress - SQL Injection

    Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.7.2 contains a sql injection caused by insufficient escaping of 'booking[service_id]' parameter, letting unauthenticated attackers extract sensitive database information.

  • 7.2 /10 High
    CVE-2026-96572 No auth

    WP Meteor Website Speed Optimization Addon - Stored XSS

    WP Meteor Website Speed Optimization Addon plugin for WordPress <= 3.4.18 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the comment author name, letting unauthenticated attackers inject scripts executed when users access the injected page, exploit requires comment author name to pass WordPress comment moderation.

  • 7.2 /10 High
    CVE-2026-96558 No auth

    Quiz and Survey Master - Stored XSS

    Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress <= 11.2.6 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in 'qsm_hidden_questions' parameter, letting unauthenticated attackers inject arbitrary scripts that execute when users access injected pages, exploit requires triggering audit trail code by forcing mlw_results INSERT failure.

  • 8.2 /10 High
    CVE-2026-96341 No auth

    WPMU DEV Forminator - Privilege Escalation

    WPMU DEV Forminator <= 1.57.3 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

  • 7.2 /10 High
    CVE-2026-96278 No auth

    WP Photo Album Plus - Stored XSS

    WP Photo Album Plus plugin for WordPress <= 9.3.03.002 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in REQUEST_URI Session History, letting unauthenticated attackers inject and execute arbitrary scripts when users access injected pages.

  • 7.2 /10 High
    CVE-2026-95684 No auth

    VikBooking Hotel Booking Engine & PMS - Stored XSS

    VikBooking Hotel Booking Engine & PMS WordPress plugin <= 1.8.15 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'attachments[name]' parameter, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.

  • 7.2 /10 High
    CVE-2026-94676 Auth required

    Tainacan Community Tainacan - Insecure Deserialization

    Tainacan Community Tainacan <= 1.3.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-94589 No auth

    Extensions For CF7 WordPress - Arbitrary File Upload

    Extensions For CF7 WordPress plugin <= 3.4.5 contains an arbitrary file upload vulnerability caused by missing validation and sanitize_file_name() bypass in extcf7_submit function, letting unauthenticated attackers upload executable files and achieve remote code execution.

  • 8.1 /10 High
    CVE-2026-94538 Auth required

    WP File Download - Authorization Bypass

    WP File Download plugin for WordPress <= 6.3.9 contains an authorization bypass caused by improper user authorization verification, letting authenticated attackers with subscriber-level access delete, move, or publish files.

  • 8.1 /10 High
    CVE-2026-94257 No auth

    SMS Alert WordPress plugin - Authentication Bypass

    SMS Alert WordPress plugin < 4.0.1 contains an authentication bypass caused by improper binding of verified phone numbers during OTP password reset, letting unauthenticated attackers reset passwords on arbitrary accounts including administrators.

  • 8.1 /10 High
    CVE-2026-94256 No auth

    SMS Alert WordPress plugin - Authentication Bypass

    SMS Alert WordPress plugin < 4.0.1 contains an authentication bypass caused by lack of verification that the logged-in account matches the one-time code, letting unauthenticated attackers sign in as any user with a stored phone number by completing a code challenge on a controlled phone.

  • 7.1 /10 High
    CVE-2026-94160 No auth

    ThemeStek ThemeStek Extras for LabtechCO Theme - Reflected XSS

    ThemeStek ThemeStek Extras for LabtechCO Theme <= 8.4 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.