Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 263 of 695

  • 8.8 /10 High
    CVE-2026-105701 Auth required

    ACPT (Premium) WordPress - Remote Code Execution

    ACPT (Premium) WordPress plugin <= 2.0.66 contains a remote code execution caused by missing capability check and unsandboxed Twig rendering in REST API form creation endpoint, letting authenticated attackers with subscriber access execute code on the server.

  • 7.3 /10 High
    CVE-2026-105571 No auth

    PickMall Lilishop - Broken Access Control

    PickMall Lilishop <= 4.2.4 contains a broken access control caused by manipulation of the Username argument in /buyer/passport/member/bindMobile, letting remote attackers bypass authorization, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-105488 Auth required

    Devolutions Server - Broken Access Control

    Devolutions Server <= 2026.3.7.0 contains a broken access control caused by missing authorization in the global vault, letting authenticated users with global vault view permission modify and delete global contacts and folders, exploit requires authenticated user with specific permission.

  • 7.3 /10 High
    CVE-2026-105486 No auth

    OSSRS srs - Authentication Bypass

    OSSRS srs <= 7.0-a1 contains an authentication bypass caused by manipulation in systemAPI.Run function in internal/proxy/api.go, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-105484 No auth

    TOTOLINK X6000R - Command Injection

    TOTOLINK X6000R 9.4.0cu.652_B20230116 contains a command injection caused by manipulation of the "file_name" argument in firmware_check function of /cgi-bin/cstecgi.cgi UploadFirmwareFile Handler, letting remote attackers execute arbitrary OS commands.

  • 7.3 /10 High
    CVE-2026-105471 No auth

    girishsaraf Online-Appointment-Booking-System - SQL Injection

    girishsaraf Online-Appointment-Booking-System contains a SQL injection caused by manipulation of the "fname" argument in signup.php Registration Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 8.5 /10 High
    CVE-2026-105317 Auth required

    Paid Member Subscriptions - SQL Injection

    Paid Member Subscriptions <= 3.1.1 contains a SQL injection caused by unsanitized input in subscriber-related queries, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 8.1 /10 High
    CVE-2026-105267 Auth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability in the tag deletion route where collaborators with Code write access can delete published releases without Releases write access, exploit requires collaborator privileges.

  • 7.5 /10 High
    CVE-2026-105072 No auth

    FluentBooking Pro - Broken Access Control

    FluentBooking Pro < 2.5.0 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-105071 No auth

    SiteVault - Sensitive Data Exposure

    SiteVault Backup, Restore, Migration & Cloning <= 1.5.17 contains an unauthenticated sensitive data exposure caused by lack of access control, letting unauthenticated attackers access sensitive data remotely, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-105070 No auth

    Salon booking system - Privilege Escalation

    Salon booking system <= 10.31.7 contains a privilege escalation caused by unauthenticated access, letting unauthenticated attackers escalate privileges without authentication.

  • 7.1 /10 High
    CVE-2026-105061 No auth

    WP Mailster - Reflected XSS

    WP Mailster <= 1.9.0.0 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-105058 Auth required

    WP User Profiles - Privilege Escalation

    WP User Profiles <= 2.7.3 contains a privilege escalation caused by improper access control in subscriber privileges, letting attackers escalate their privileges, exploit requires subscriber account.

  • 7.1 /10 High
    CVE-2026-104944 PoC publicNo auth

    TP-Link Tapo - Denial of Service

    TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP daemon, letting unauthenticated attackers with network access cause denial of service by crashing the main service, exploit requires network access to UDP service.

  • 7.5 /10 High
    CVE-2026-104850 No auth

    MCP TypeScript SDK - Authentication Bypass

    MCP TypeScript SDK <= 1.12.0 and < 1.31.0, 2.x < 2.2.0 contains an OAuth client authorization bypass caused by unbound stored credentials to authorization servers, letting malicious MCP servers receive client OAuth credentials without user interaction, exploit requires untrusted MCP server connection.