Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 182 of 681

  • 7.1 /10 High
    CVE-2026-102388 No auth

    WPMU DEV Forminator - Stored XSS

    WPMU DEV Forminator <= 1.57.3 contains a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts on users, exploit requires no special privileges.

  • 8.4 /10 High
    CVE-2026-101947 No auth

    ExifTool for photo and video - Command Injection

    ExifTool for photo and video 5.0.1-gms by CellHubs contains a command injection caused by improper escaping of embedded single quotes in CSV-export path shell command construction, letting attackers execute arbitrary commands remotely, exploit requires crafted file paths.

  • 7.2 /10 High
    CVE-2026-101920 No auth

    Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress - Stored XSS

    Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin <= 5.2.12 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' href attribute, letting unauthenticated attackers inject arbitrary scripts that execute when users access the page, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-100196 No auth

    LazyLoad Plugin - Stored XSS

    LazyLoad Plugin for WordPress <= 2.4.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'comment_content', letting unauthenticated attackers inject scripts executed by users, exploit requires admin approval of crafted comment.

  • 7.2 /10 High
    CVE-2026-100178 No auth

    WPAdverts – Classifieds Plugin - Stored XSS

    WPAdverts – Classifieds Plugin for WordPress <= 2.3.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'adverts_location' parameter, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.

  • 7.2 /10 High
    CVE-2026-100161 No auth

    Photo Reviews for WooCommerce - Stored XSS

    Photo Reviews for WooCommerce WordPress plugin <= 1.2.30 contains a stored XSS caused by insufficient sanitization of 'wcpr_image_upload_id' parameter, letting unauthenticated attackers inject scripts executed on review pages, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-100147 CISA KEVNo auth

    FunnelKit – Funnel Builder for WooCommerce Checkout - Stored XSS

    FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.16.0.5 contains a stored XSS caused by insufficient sanitization and escaping of 'shipping_first_name' parameter, letting unauthenticated attackers execute scripts on user pages.

  • 7.5 /10 High
    CVE-2026-97076 No auth

    WP Media WP Rocket - Code Injection

    WP Media WP Rocket < 3.23.5 contains a code injection vulnerability caused by executable regular expression error, letting attackers inject code remotely, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-96809 No auth

    MultiNet Interactive AB EduAdmin Booking - SQL Injection

    MultiNet Interactive AB EduAdmin Booking < 6.0.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-96761 No auth

    Welcart Welcart e-Commerce - Reflected XSS

    Welcart Welcart e-Commerce <= 2.12.3 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts via crafted input, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-96671 No auth

    fifu.app Featured Image from URL - Cross Site Request Forgery

    fifu.app Featured Image from URL <= 6.0.7 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 7.1 /10 High
    CVE-2026-96607 No auth

    Basix NEX-Forms - Reflected XSS

    Basix NEX-Forms nex-forms-express-wp-form-builder <= 9.3.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-96553 No auth

    Damian Góra FiboSearch - Reflected XSS

    Damian Góra FiboSearch ajax-search-for-woocommerce <= 1.34.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts via crafted input, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-96461 No auth

    TMS Amelia ameliabooking - Broken Access Control

    TMS Amelia ameliabooking <= 2.4.10 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-96336 No auth

    WPMU DEV Forminator - Authentication Bypass

    WPMU DEV Forminator <= 1.57.2 contains an authentication bypass by spoofing caused by identity spoofing, letting attackers bypass authentication, exploit requires no special privileges.