Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 18 of 891

  • 9.1 /10 Critical
    CVE-2026-116557 No auth

    WP Booking System - Booking Calendar - Broken Access Control

    WP Booking System - Booking Calendar plugin for WordPress <= 2.1.0.5 contains a broken access control caused by missing capability check in wpbs_action_ajax_calendar_remove_note() function, letting authenticated attackers with Subscriber-level access delete arbitrary calendar notes.

  • 7.2 /10 High
    CVE-2026-116548 No auth

    VikRentCar Car Rental Management System - Stored XSS

    VikRentCar Car Rental Management System WordPress plugin <= 1.4.10 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'optionals' parameter, letting unauthenticated attackers inject scripts executed on user page access.

  • 7.2 /10 High
    CVE-2026-116522 No auth

    Relevanssi – A Better Search WordPress plugin - Stored XSS

    Relevanssi – A Better Search WordPress plugin <= 4.28.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires comment indexing and highlighting enabled with specific search-result permalink.

  • 7.2 /10 High
    CVE-2026-116520 No auth

    PPWP Password Protect Pages - Stored XSS

    PPWP – Password Protect Pages WordPress plugin <= 1.9.26 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'desc_below_form' shortcode attribute, letting unauthenticated attackers inject scripts executed by users accessing the page.

  • 9.8 /10 Critical
    CVE-2026-116512 CISA KEVNo auth

    Project Manager - Remote Code Execution

    Project Manager WordPress plugin <= 4.1.1 contains a remote code execution caused by unsanitized 'id' parameter concatenated into a validation rule string, letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted REST request.

  • 8.8 /10 High
    CVE-2026-116086 Auth required

    Konflux-ci - Information Disclosure

    Konflux-ci contains an information disclosure caused by unsanitized user input in workflow scripts, letting attackers with permission to trigger workflows inject malicious filters and expose sensitive data in logs.

  • 7.2 /10 High
    CVE-2026-115840 No auth

    VikRentCar Car Rental Management System - Stored XSS

    VikRentCar Car Rental Management System WordPress plugin <= 1.4.9 contains a stored XSS caused by insufficient sanitization of 'poplink' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires WordPress nonce accessible publicly.

  • 8.6 /10 High
    CVE-2026-114217 No auth

    Konflux-ci - Broken Access Control

    Konflux-ci contains a sensitive data exposure caused by storing GitHub access tokens in plaintext on the runner without cleanup, letting local attackers access credentials and modify repositories, exploit requires local access to CI environment.

  • 7.2 /10 High
    CVE-2026-111254 No auth

    W3 Total Cache WordPress Plugin - Stored XSS

    W3 Total Cache WordPress plugin <= 2.10.7 contains a stored XSS caused by insufficient sanitization and escaping of the 'comment' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires prior Pro license with REST caching enabled and attacker having approved commenter identity.

  • 7.2 /10 High
    CVE-2026-110530 No auth

    WordPress FeedWordPress - Stored XSS

    FeedWordPress plugin for WordPress <= 2026.0517 contains a stored XSS caused by insufficient sanitization of syndicated RSS/Atom feed content in SyndicatedPost functions, letting unauthenticated attackers inject scripts executed by users visiting injected pages.

  • 8.7 /10 High
    CVE-2026-110176 No auth

    Drupal File Force Download - Broken Access Control

    Drupal File Force Download module 7.1.0 through 7.1.2 contains an access control bypass caused by improper header handling in hook_file_download(), letting unauthenticated attackers download files in temporary:// or other non-private schemes, exploit requires crafted URL with download=1 parameter.

  • 7.2 /10 High
    CVE-2026-109997 No auth

    Ninja Forms - Stored XSS

    Ninja Forms WordPress plugin <= 3.15.5 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'formData.extra' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-109234

    Meow Lightbox WordPress Plugin - Stored XSS

    Meow Lightbox WordPress plugin <= 5.6.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'post_content' parameter, letting unauthenticated attackers execute arbitrary JavaScript, exploit requires specific plugin settings and stored HTML submission surface.

  • 9.8 /10 Critical
    CVE-2026-109220 No auth

    PDF Invoice for WooCommerce + Drag and Drop Template Builder - Remote Code Execution

    PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress <= 7.1.1 contains a PHP Object Injection caused by insufficient sanitization of the 'customer_note' parameter, letting unauthenticated attackers execute code on the server, exploit requires triggering checkout via public Store API with specific payment methods.

  • 7.5 /10 High
    CVE-2026-109197 No auth

    WP Directory Kit - SQL Injection

    WP Directory Kit plugin for WordPress <= 1.6.0 contains a SQL injection caused by insufficient escaping of the 'idfield' parameter, letting unauthenticated attackers extract sensitive database information remotely.