Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 3 of 677
- 8.1 /10 HighCVE-2026-103895 No auth
miniOrange OTP Login, Verification and SMS Notifications - Authentication Bypass
miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress <= 5.5.8 contains an authentication bypass caused by improper handling of Delay OTP grace flag in mo_by_pass_login(), letting unauthenticated attackers login as any user including admins, exploit requires OTP-only login and Delay OTP Verification enabled with target account in Delay OTP interval.
- 9.8 /10 CriticalCVE-2026-109219 No auth
Mang Board WordPress Plugin - Unrestricted File Upload
Mang Board WordPress plugin <= 2.4.4 contains an arbitrary file upload vulnerability caused by missing file extension validation in mbw_file_upload function, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires guest posts enabled.
- 7.2 /10 HighCVE-2026-109998 No auth
Mang Board WordPress Plugin - Stored XSS
Mang Board WordPress plugin <= 2.4.3 contains a stored XSS caused by insufficient sanitization and escaping of the 'content' parameter in wp_ajax_nopriv_mb_template endpoint, letting unauthenticated attackers inject scripts executed by users, exploit requires public access to the endpoint without authentication.
- 9.8 /10 CriticalCVE-2026-109515 No auth
MailOptin WordPress Plugin - Privilege Escalation
MailOptin WordPress plugin <= 1.2.78.6 contains a privilege escalation caused by lack of allow-list validation on optin_data[form_custom_field_mappings] in subscribe_to_email_list endpoint, letting unauthenticated attackers overwrite any user password and take over accounts, exploit requires a published WordPress User Registration opt-in form.
- 7.5 /10 HighCVE-2026-110590 No auth
Klarna for WooCommerce - Authorization Bypass
Klarna for WooCommerce plugin for WordPress <= 4.13.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers access full order PII and secret order keys, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-14177 No auth
IKAS Technology Inc. Ikas E-Commerce Infrastructure - Authentication Bypass
IKAS Technology Inc. Ikas E-Commerce Infrastructure through 2026-07-13 contains an account footprinting vulnerability caused by observable response discrepancies, letting attackers gather account information, exploit requires no special privileges.
- 7.1 /10 HighCVE-2026-96339 No auth
Houzez.co Houzez - Reflected XSS
Houzez.co Houzez <= 4.4.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.
- 7.2 /10 HighCVE-2026-109193 No auth
HivePress Business Directory - Stored XSS
HivePress Business Directory, Listings & Classified Ads Plugin for WordPress <= 1.7.32 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in custom user attribute slug, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires admin configuration of custom user attribute with display_format placing %value% in href, src, or style context.
- 9.3 /10 CriticalCVE-2026-94388 No auth
halfdata Green Popups - SQL Injection
halfdata Green Popups < 7.6.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 7.2 /10 HighCVE-2026-96768 No auth
GoSMTP Pro - Stored XSS
GoSMTP Pro WordPress plugin <= 1.2.3 contains a stored XSS caused by insufficient input sanitization and output escaping in email log body, letting unauthenticated attackers inject scripts executed when users access injected pages.
- 7.5 /10 HighCVE-2026-107746 No auth
FunnelKit – Funnel Builder for WooCommerce Checkout - Authorization Bypass
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.16.0.6 contains an authorization bypass caused by improper user authorization verification in shortcode rendering, letting unauthenticated attackers retrieve billing PII via sequential order IDs, exploit requires FunnelKit thank-you page with specific shortcodes.
- 8.8 /10 HighCVE-2026-111382 No auth
FreeRDP - Out of Bounds Read/Write
FreeRDP < 3.32.0 contains a client-side heap out-of-bounds write vulnerability caused by improper handling of RDPGFX AVC444 or AVC444v2 frames in general_LumaToYUV444 and general_ChromaV2ToYUV444, letting malicious RDP servers corrupt client memory and potentially execute code, exploit requires attacker-controlled RDP server.
- 8.8 /10 HighCVE-2026-111380 No auth
FreeRDP - Integer Overflow
FreeRDP 3.29.0 before 3.32.0 contains an integer overflow in Apple audin backends caused by improper UINT32 arithmetic in audio buffer size calculation, letting malicious RDP servers cause heap out-of-bounds write on macOS and iOS clients, exploit requires malicious RDP server.
- 7.5 /10 HighCVE-2026-111378 No auth
FreeRDP - Denial of Service
FreeRDP 3.0.0 < 3.32.0 contains an uncontrolled resource consumption vulnerability caused by improper handling in parse_nla_mode_pdu, letting unauthenticated attackers exhaust server memory by sending malformed TLS streams, exploit requires no authentication.
- 7.7 /10 HighCVE-2026-111389 PoC publicAuth required
Frappe HRMS - SQL Injection
Frappe HRMS 14.x < 14.38.2, 15.x < 15.64.0, and 16.x < 16.18.0 contain a SQL injection caused by missing input validation in some endpoints, letting authenticated attackers extract sensitive database information.