Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 19 of 891

  • 7.2 /10 High
    CVE-2026-107759 No auth

    WPO365 MICROSOFT 365 GRAPH MAILER - Stored XSS

    WPO365 MICROSOFT 365 GRAPH MAILER plugin for WordPress <= 6.2 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'Subject' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires mail-sending feature with incomplete OAuth authorization.

  • 7.2 /10 High
    CVE-2026-107750 No auth

    WooCommerce PDF Invoices & Packing Slips - Stored XSS

    WooCommerce PDF Invoices & Packing Slips plugin <= 5.16.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in billing_address and customer_note parameters, letting unauthenticated attackers inject scripts executed on page access, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-107653 No auth

    SureCart WordPress Plugin - Stored XSS

    SureCart WordPress plugin <= 4.9.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed when users access affected pages, exploit requires comment approval and visibility on pages loading SureCart web-component bundle.

  • 8.8 /10 High
    CVE-2026-104012 No auth

    Rox Appointment Booking - Privilege Escalation

    Rox Appointment Booking WordPress plugin <= 1.3.1 contains a privilege escalation via mass assignment in the public REST endpoint, letting unauthenticated attackers persist arbitrary wp_user_id and email, exploit requires an administrator to open and save the poisoned customer record.

  • 8.1 /10 High
    CVE-2026-103898 CISA KEVNo auth

    Wp Social Login and Register Social Counter - Authentication Bypass

    Wp Social Login and Register Social Counter plugin for WordPress <= 3.2.2 contains an authentication bypass caused by improper verification of OAuth provider email in the social login REST callback, letting unauthenticated attackers gain authenticated sessions as any user, exploit requires attacker-controlled OAuth account with matching email.

  • 9.1 /10 Critical
    CVE-2026-103882 No auth

    Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress - Arbitrary File Deletion

    Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress <= 1.1.9 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in post_delete_assessment_file_by_id, letting unauthenticated attackers delete arbitrary files, exploit requires access to a public nonce in frontend JavaScript.

  • 8.4 /10 High
    CVE-2026-102212 No auth

    Opengear IM72XX, CM71XX, ACM70XX - Buffer Overflow

    Opengear IM72XX, CM71XX, and ACM70XX firmware 4.8.0 through 5.5.2 contain a heap-based buffer overflow caused by an overlong Content-Disposition name field in multipart/form-data POST requests, letting unauthenticated remote attackers crash the index.cgi process.

  • 7.2 /10 High
    CVE-2026-97645 No auth

    Gravity Forms - Stored XSS

    Gravity Forms plugin for WordPress <= 3.1.2 contains a stored XSS caused by insufficient input sanitization and output escaping in List Field, letting unauthenticated attackers inject scripts executed by admins, exploit requires admin interaction.

  • 7.5 /10 High
    CVE-2026-97638 No auth

    Forminator Forms - Broken Access Control

    Forminator Forms WordPress plugin <= 1.57.3.1 contains an insecure direct object reference caused by missing validation on 'previous_draft_id' parameter, letting unauthenticated attackers delete or overwrite other users' drafts, exploit requires attacker to have victim's draft_id.

  • 7.2 /10 High
    CVE-2026-96894 No auth

    ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce - Stored XSS

    ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress <= 1.17.10 contains a stored XSS caused by insufficient input sanitization and output escaping in inbound email body, letting unauthenticated attackers inject scripts executed by users, exploit requires attacker to mimic CRM outbound email.

  • 7.1 /10 High
    CVE-2026-94175 No auth

    All In One Login - Reflected XSS

    All In One Login <= 2.4.1 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 9.4 /10 Critical
    CVE-2026-93327 Auth required

    Google Cloud Application Integration - Insecure Deserialization

    Google Cloud Application Integration < 2026-09-11 contains an insecure deserialization vulnerability in SubWorkflow task, letting authenticated attackers execute arbitrary code using malicious serialized objects.

  • 8.0 /10 High
    CVE-2026-91917

    Dell OpenManage Enterprise - Remote Code Execution

    Dell OpenManage Enterprise < 4.8.0 contains an improper input validation vulnerability, letting low privileged attackers with adjacent network access execute arbitrary code, exploit requires adjacent network access.

  • 7.1 /10 High
    CVE-2026-91914

    Dell OpenManage Enterprise - Authentication Bypass

    Dell OpenManage Enterprise < 4.8.0 contains an authentication bypass by spoofing vulnerability, letting unauthenticated adjacent network attackers steal sessions, exploit requires adjacent network access.

  • 8.8 /10 High
    CVE-2026-91913 Auth required

    Dell OpenManage Enterprise - Command Injection

    Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting low privileged remote attackers execute arbitrary commands, exploit requires remote access.