Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 18 of 677

  • 7.5 /10 High
    CVE-2026-109468 No auth

    ASP.NET Core - Denial of Service

    ASP.NET Core contains a denial of service vulnerability caused by allocation of resources without limits or throttling, letting unauthorized attackers exhaust resources remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-111322 No auth

    Archon - Authentication Bypass

    Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability caused by unauthenticated access to the /api/* control API binding to 0.0.0.0, letting unauthenticated attackers execute commands on the host as the Archon user, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-110812 Auth required

    Amazon Neptune - Insecure Deserialization

    Amazon Neptune engine contains an insecure deserialization vulnerability in the Gremlin graph data import component, letting authenticated remote actors with standard database permissions execute arbitrary code and access internal credentials.

  • 8.1 /10 High
    CVE-2026-55587 No auth

    AliasVault - Authentication Bypass

    AliasVault browser extension < 0.29.4 contains an authentication bypass caused by lack of origin and relying-party identifier verification in passkey requests, letting attackers obtain valid assertions for different websites, exploit requires extension installed, unlocked, configured, and user approval.

  • 8.7 /10 High
    CVE-2026-104150 No auth

    AdonisJS HTTP Server - Denial of Service

    AdonisJS HTTP Server < 8.2.2 and < 9.1.1 contains a denial of service caused by adjacent greedy repetitions with overlapping character classes in router.matchers.slug(), letting attackers cause excessive CPU use and block event loop, exploit requires attacker-controlled route parameter.

  • 7.1 /10 High
    CVE-2026-105065 No auth

    8theme.com XStore - Reflected XSS

    8theme.com XStore < 9.7.9 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-97668 No auth

    Abandoned Cart Pro for WooCommerce - SQL Injection

    Abandoned Cart Pro for WooCommerce <= 10.8.0 contains a SQL injection caused by insufficient escaping of user-supplied data in update_guest_persistent_cart(), letting unauthenticated attackers extract and modify usermeta data, exploit requires crafted input in checkout fields.

  • 9.8 /10 Critical
    CVE-2026-97657 PoC publicNo auth

    Abandoned Cart Pro for WooCommerce - Authentication Bypass

    Abandoned Cart Pro for WooCommerce <= 10.8.0 contains an authentication bypass caused by malleable AES-CTR encryption and bypassable HMAC in cart-recovery tokens, letting unauthenticated attackers achieve full account takeover via crafted cart IDs, exploit requires possession of a legitimate cart-recovery link.

  • 7.2 /10 High
    CVE-2026-97398 No auth

    FV Flowplayer Video Player - Stored XSS

    FV Flowplayer Video Player plugin for WordPress <= 7.5.54.7212 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'synopsis' shortcode attribute, letting unauthenticated attackers inject scripts, exploit requires 'Parse Vimeo and YouTube links' option enabled and liststyle attribute set to 'season'.

  • 7.2 /10 High
    CVE-2026-97278 Auth required

    WP SYNTEX Polylang - Insecure Deserialization

    WP SYNTEX Polylang <= 3.8.9 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-97205 PoC publicNo auth

    NGINX Plus & Open Source - Use After Free

    NGINX Plus and NGINX Open Source contain a use-after-free vulnerability in ngx_http_core_module when asynchronous file I/O is enabled and processing SSI pages with "include virtual" commands, letting remote attackers cause denial-of-service, memory corruption, or code execution, exploit requires ASLR disabled or bypass.

  • 7.5 /10 High
    CVE-2026-96661 No auth

    Gmedia Photo Gallery - SQL Injection

    Gmedia Photo Gallery WordPress plugin <= 1.25.1 contains a time-based SQL injection caused by insufficient escaping of the 'gmedia__in' parameter in the mobile app endpoint, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication or session.

  • 7.2 /10 High
    CVE-2026-95816 No auth

    Smart Forms - Stored XSS

    Smart Forms WordPress plugin <= 2.6.104 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'formString' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires no authentication by default.

  • 7.5 /10 High
    CVE-2026-95808 No auth

    10Web Form Maker - SQL Injection

    Form Maker by 10Web WordPress plugin <= 1.15.48 contains a blind SQL injection caused by insufficient escaping of the 'inputs' parameter, letting unauthenticated attackers extract sensitive database information, exploit requires nonce from public pages.

  • 7.2 /10 High
    CVE-2026-94377 No auth

    Verified Reviews WordPress Plugin - Stored XSS & Authentication Bypass

    Verified Reviews WordPress plugin <= 2.4.6 contains a stored cross-site scripting caused by insufficient sanitization and output escaping of the 'moderation' parameter, letting unauthenticated attackers inject scripts executed on page access, exploit requires crafted JSON with boolean true values for idWebsite and sign.