Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 180 of 681
- 8.8 /10 HighCVE-2026-108550 Auth required
SkillHub - Broken Access Control
SkillHub < 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController, letting authenticated attackers take over other accounts by abusing the merge flow, exploit requires attacker to be authenticated.
- 8.1 /10 HighCVE-2026-108549 No auth
cc-connect - Authentication Bypass
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go, letting remote attackers forge privileged updates and execute commands, exploit requires no webhook_secret configured.
- 7.3 /10 HighCVE-2026-108548 No auth
AstronRPA - Authentication Bypass
AstronRPA <= 1.1.6 contains an authentication bypass caused by OpenResty gateway's auth_handler.lua accepting any Bearer token without validation, letting unauthenticated attackers act as any user by spoofing headers.
- 7.5 /10 HighCVE-2026-108546 No auth
Spotweb - Command Injection
Spotweb <= 1.5.8 contains a command injection caused by unescaped shell metacharacters in spot titles in the runcommand NZB handler, letting remote attackers execute OS commands as the Spotweb PHP process, exploit requires user to download malicious spots.
- 9.8 /10 CriticalCVE-2026-108474 No auth
JetBrains Exposed - SQL Injection
JetBrains Exposed < 1.5.1 contains a SQL injection caused by unescaped string arguments in several SQL functions, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-108161 No auth
FusionPBX - Command Injection
FusionPBX through 5.6.5 contains a command injection vulnerability caused by improper sanitization of caller ID values in call_recordings::download(), letting unauthenticated attackers execute OS commands as the web server user when privileged users download multiple recordings as a ZIP, exploit requires record_name filename template enabled.
- 7.2 /10 HighCVE-2026-107742 No auth
10Web Booster - Stored XSS
10Web Booster WordPress plugin <= 2.34.8 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'author' parameter, letting unauthenticated attackers inject scripts executed when users access the injected page.
- 7.2 /10 HighCVE-2026-107657 No auth
HivePress Business Directory, Listings & Classified Ads Plugin - Stored XSS
HivePress Business Directory, Listings & Classified Ads Plugin for WordPress <= 1.7.31 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in custom user attribute fields, letting unauthenticated attackers inject scripts executed on user page access, exploit requires admin configuration of text-type custom user attribute with HTML attribute context and enabled front-end user profiles.
- 9.1 /10 CriticalCVE-2026-107645 No auth
Blocksy Companion WordPress Plugin - Privilege Escalation
Blocksy Companion WordPress plugin <= 2.1.58 contains a privilege escalation caused by disabling Dokan's vendor-registration nonce check and trusting attacker-supplied role in AJAX handler, letting unauthenticated attackers elevate to vendor and auto-authenticate.
- 9.8 /10 CriticalCVE-2026-106610 PoC publicNo auth
miniOrange miniorange otp verification - Broken Access Control
miniOrange miniorange otp verification <= 5.5.7 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
- 7.5 /10 HighCVE-2026-106609 No auth
Bayarcash WooCommerce - Broken Access Control
Bayarcash WooCommerce <= 4.4.2 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-106608 Auth required
Automattic WooCommerce - Privilege Escalation
Automattic WooCommerce 9.8.0 through 11.1.2 contains a privilege escalation caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.
- 7.2 /10 HighCVE-2026-106606 Auth required
YITH YITH WooCommerce Affiliates - Insecure Deserialization
YITH YITH WooCommerce Affiliates <= 3.31.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-105892 No auth
rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress - Path Traversal
rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers access arbitrary files, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-105889 No auth
Tickera Tickera - SQL Injection
Tickera Tickera tickera-event-ticketing-system <= 3.6.0.6 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.