Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 17 of 891

  • 8.1 /10 High
    CVE-2026-119977 CISA KEVNo auth

    WordPress Core - Remote Code Execution

    WordPress Core 4.7 through 7.1.3 contains a remote code execution caused by predictable, web-accessible staging paths during full-package core upgrades, letting unauthenticated attackers execute code on the server during upgrade window.

  • 7.5 /10 High
    CVE-2026-119163 No auth

    FunnelKit Automations WordPress - SQL Injection

    FunnelKit Automations WordPress plugin <= 3.8.5.2 contains a time-based SQL injection caused by insufficient escaping of 'bwfan_cart_id' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires crafted bwfan_cart_id during guest Store API checkout with WooCommerce cart nonce.

  • 7.2 /10 High
    CVE-2026-119162

    User Submitted Posts WordPress Plugin - Stored XSS

    User Submitted Posts WordPress plugin <= 20260916 contains a stored DOM-based cross-site scripting caused by insufficient sanitization and escaping of 'user-submitted-content' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit requires 'publish immediately' option enabled.

  • 9.8 /10 Critical
    CVE-2026-119096 CISA KEVNo auth

    Uncanny Toolkit for LearnDash - Authentication Bypass

    Uncanny Toolkit for LearnDash WordPress plugin <= 3.8.2 contains an authentication bypass caused by parser-differential flaw in email parameter handling in uo_login_action(), letting unauthenticated attackers bypass account verification and suspension controls, exploit requires nonce from ult-refresh-nonce endpoint.

  • 7.2 /10 High
    CVE-2026-119089 No auth

    ThirstyAffiliates Affiliate Links - Stored XSS

    ThirstyAffiliates Affiliate Links plugin for WordPress <= 3.12.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts on block themes, exploit requires one prior approved comment.

  • 7.2 /10 High
    CVE-2026-119065 No auth

    Shipping Zones by Drawing for WooCommerce - Stored XSS

    Shipping Zones by Drawing for WooCommerce <= 3.3.0 contains a stored cross-site scripting caused by improper sanitization and output encoding of 'szbd-picked' checkout parameter, letting unauthenticated attackers inject scripts in admin order view, exploit requires guest checkout order submission with crafted payload.

  • 9.8 /10 Critical
    CVE-2026-118636 No auth

    Apache MINA - Insecure Deserialization

    Apache MINA 3.0 codec module contains an insecure deserialization vulnerability caused by JavaNativeMessageDecoder calling ObjectInputStream.readObject() without a class filter, letting attackers execute remote code via crafted frames, exploit requires untrusted peer interaction.

  • 9.8 /10 Critical
    CVE-2026-118235 No auth

    SimpleForm WordPress Plugin - Unrestricted File Upload

    SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin <= 3.10.2 contains an arbitrary file upload vulnerability caused by missing server-side file key allowlist and improper extension validation in handle_upload, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires access to the nonce in public form data.

  • 7.4 /10 High
    CVE-2026-118147 No auth

    Visual Studio - Spoofing

    Visual Studio contains an improper certificate validation vulnerability caused by inadequate certificate checks, letting unauthorized attackers perform network spoofing, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-118070 No auth

    Welcart e-Commerce - Stored XSS

    Welcart e-Commerce plugin for WordPress <= 2.12.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'gid' parameter, letting unauthenticated attackers inject scripts executed by administrators viewing orders.

  • 7.2 /10 High
    CVE-2026-118057 No auth

    Shield Security - Stored XSS

    Shield Security WordPress plugin <= 22.3.2 contains a stored XSS caused by insufficient sanitization of the 'REQUEST_URI' parameter in the hidden 'path' column of ForTraffic.php, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication.

  • 8.0 /10 High
    CVE-2026-117681

    Konflux-ci - Privilege Escalation

    Konflux-ci contains a privilege escalation caused by automatic disabling of TLS certificate verification in the user interface proxy for internal backend services, letting adjacent network attackers capture cluster-scoped tokens and gain full administrative control, exploit requires adjacent network access to intercept traffic.

  • 9.3 /10 Critical
    CVE-2026-117656 No auth

    Assent - Authentication Bypass

    Assent 0.1.25 to < 0.3.2 contains an acceptance of extraneous untrusted data vulnerability in Sign in with Apple strategy caused by unverified user parameter merging over verified ID token claims, letting unauthenticated remote attackers impersonate users via the authorization callback user parameter.

  • 8.4 /10 High
    CVE-2026-116964 Auth required

    Konflux-ci - Command Injection

    Konflux-ci contains a command injection caused by unvalidated script output evaluation in environment export scripts, letting attackers with repository write access execute arbitrary code in CI/CD workflows.

  • 7.4 /10 High
    CVE-2026-116755 Auth required

    SoftIron HyperCloud - Command Injection

    SoftIron HyperCloud 1.0 through 2.6.17 contains a command injection caused by unquoted here-document terminator in VM template content in the Orchestrator component, letting authenticated users with management plane access execute arbitrary OS commands, exploit requires valid credentials and management plane access.