Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 181 of 681
- 8.8 /10 HighCVE-2026-105885 Auth required
10Web Slider - Insecure Deserialization
10Web Slider by 10Web <= 1.2.62 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-104899 No auth
GeoDirectory WP Business Directory Plugin - Local File Inclusion
GeoDirectory WP Business Directory Plugin and Classified Listings Directory plugin for WordPress <= 2.8.187 contains a local file inclusion caused by improper sanitization of 'design_type' parameter, letting unauthenticated attackers execute arbitrary PHP code remotely, exploit requires no authentication or user interaction.
- 9.8 /10 CriticalCVE-2026-104803 No auth
WPCOM Member - Authentication Bypass
WPCOM Member plugin for WordPress <= 1.7.27 contains an authentication bypass caused by missing nonce validation and OAuth state verification in social-login callback, letting unauthenticated attackers log in as any user with known social provider ID, exploit requires configured social provider and knowledge of victim's openid or unionid.
- 9.1 /10 CriticalCVE-2026-104801 No auth
PPOM Product Addons & Custom Fields for WooCommerce - Arbitrary File Deletion
PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress <= 34.0.10 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in rename_files function, letting unauthenticated attackers delete arbitrary files and read web-accessible files, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-104797 No auth
Advanced Form Integration — Connect Forms to 300+ Apps - Authentication Bypass
Advanced Form Integration — Connect Forms to 300+ Apps WordPress plugin <= 2.9.0 contains an authentication bypass via unverified password change caused by lack of submitter identity and capability checks in the Ultimate Member Update Profile Field action, letting unauthenticated attackers change any user's password including administrators, exploit requires pre-configured Contact Form 7 integration mapping email, field key, and value.
- 8.8 /10 HighCVE-2026-104766 Auth required
Appointment Booking Plugin – LatePoint - Privilege Escalation
Appointment Booking Plugin – LatePoint for WordPress <= 5.7.3 contains a privilege escalation caused by lack of server-side validation in OsSettingsController::update(), letting authenticated attackers with settings__edit capability escalate privileges by changing default customer role to administrator, exploit requires settings__edit capability granted by admin.
- 8.1 /10 HighCVE-2026-104759
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) - Authentication Bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 contains an authentication bypass caused by improper nonce validation in Id_Token_Service_Deprecated::process_openidconnect_token(), letting unauthenticated attackers replay valid id_tokens to authenticate as any user, exploit requires use_id_token_parser_v2 plugin option enabled.
- 7.2 /10 HighCVE-2026-104752 Auth required
Rank Math SEO WordPress plugin - Unrestricted File Upload
Rank Math SEO WordPress plugin < 1.0.280 contains an unrestricted file upload vulnerability caused by improper file type validation in the settings import feature, letting administrator users upload PHP files and execute code remotely, exploit requires administrator privileges.
- 9.8 /10 CriticalCVE-2026-104732 No auth
Advanced IP Blocker WordPress - Authentication Bypass
Advanced IP Blocker WordPress plugin <= 8.13.13 contains an authentication bypass caused by missing server-side verification in 2FA step-2 processing, letting unauthenticated attackers bypass login by brute-forcing TOTP codes, exploit requires known user_id with 2FA enabled.
- 8.8 /10 HighCVE-2026-104725 Auth required
Groundhogg CRM - Privilege Escalation
Groundhogg CRM, Newsletters, and Marketing Automation plugin for WordPress <= 4.9 contains a privilege escalation caused by missing ownership and capability checks in process_edit() function, letting authenticated users with edit_contacts capability escalate to administrator by linking contacts to admin user IDs and using auto-login URLs, exploit requires authenticated user with sales_rep-level access or higher.
- 8.8 /10 HighCVE-2026-104723 Auth required
LifterLMS WordPress Plugin - Insecure Deserialization
LifterLMS WordPress plugin <= 10.2.1 contains a PHP Object Injection caused by deserialization of untrusted input during lesson creation, letting authenticated users with edit_course capability inject PHP objects, exploit requires specific user roles and presence of a POP chain.
- 9.8 /10 CriticalCVE-2026-104398 No auth
VillaTheme AFFI – Affiliate Marketing for WooCommerce - Insecure Deserialization
VillaTheme AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.2 /10 HighCVE-2026-104021 Auth required
Fastcache WordPress Plugin - Code Injection
Fastcache by Host.it WordPress plugin <= 1.7.4 contains a code injection caused by improper sanitization of the cache_cookie_exclude setting, letting authenticated administrators inject arbitrary Apache directives via .htaccess, exploit requires admin privileges.
- 9.8 /10 CriticalCVE-2026-103889 PoC publicNo auth
3D Product configurator for WooCommerce - Remote Code Execution
3D Product configurator for WooCommerce plugin for WordPress <= 2.16.2 contains a remote code execution caused by missing authentication and nonce checks and unsanitized 'xpv_image' parameter in a Dompdf-rendered HTML template with PHP execution enabled, letting unauthenticated attackers execute code on the server, exploit requires unauthenticated POST request.
- 7.5 /10 HighCVE-2026-103071 No auth
VillaTheme Thank You Page Customizer for WooCommerce - Code Injection
VillaTheme Thank You Page Customizer for WooCommerce <= 1.2.3 contains a code injection vulnerability caused by improper control of code generation, letting attackers inject and execute arbitrary code, exploit requires crafted input.