Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 33 of 891
- 8.1 /10 HighCVE-2026-115346 No auth
Avada Website Builder For WordPress & WooCommerce - Unrestricted File Upload
Avada Website Builder For WordPress & WooCommerce theme for WordPress <= 7.16.2 contains an unrestricted file upload vulnerability caused by insufficient file type validation in convert_palette_images_to_truecolor() function, letting unauthenticated attackers upload executable files and achieve remote code execution.
- 7.5 /10 HighCVE-2026-114443 Auth required
Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress - Authentication Bypass
Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin < 2.191 contains a broken authentication caused by lack of password verification before accepting two-factor authenticator codes, letting attackers with valid authenticator codes log in as any user including administrators without passwords, exploit requires possession of valid authenticator code.
- 7.5 /10 HighCVE-2026-114422 No auth
Enable Media Replace WordPress - Insecure Deserialization
Enable Media Replace WordPress plugin < 4.2.3 contains a PHP Object Injection caused by unrestricted classes during deserialization in media replace-and-update-links routine, letting unauthenticated attackers escalate to remote code execution if attacker-controlled PHP/HTML files exist, exploit requires user with upload access to perform media replacement.
- 9.0 /10 CriticalCVE-2026-112905 Auth required
Vvveb - Broken Access Control
Vvveb < 1.0.8.7 contains an IDOR vulnerability caused by improper authorization on admin/auth-token endpoint, letting authenticated administrators read and overwrite other administrators' API tokens, exploit requires administrator authentication.
- 10.0 /10 CriticalCVE-2026-112816 PoC public
Canonical LXD - Authentication Bypass
Canonical LXD < 4.0.15, < 5.0.11, < 5.21.9, < 6.10.1 contains an authentication bypass caused by improper certificate validation in the HTTPS listener, letting unauthenticated attackers authenticate as any trusted client and gain full cluster access, exploit requires crafted certificate chain.
- 7.2 /10 HighCVE-2026-112365 No auth
easy.jobs WordPress Plugin - Stored XSS
easy.jobs WordPress plugin <= 2.8.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'cover_letter' parameter, letting unauthenticated attackers inject scripts executed when an admin views the candidate's Application tab, exploit requires admin interaction with crafted link.
- 7.6 /10 HighCVE-2026-112347 Auth required
Kirki WordPress Plugin - Broken Access Control
Kirki plugin for WordPress before 6.4.1 contains a broken access control vulnerability caused by insufficient per-object capability checks in the page REST API, letting users with Kirki edit access modify any non-trashed post including private or draft content, exploit requires user to have Kirki edit access.
- 7.5 /10 HighCVE-2026-111578 No auth
WooCommerce PDF Invoices & Packing Slips - Stored Cross-Site Scripting
WooCommerce PDF Invoices & Packing Slips plugin > 5.16.2 and < 5.16.5 contains a stored cross-site scripting caused by improper escaping of customer-supplied order fields in invoice and packing-slip documents, letting unauthenticated guest users store malicious scripts executed by shop administrators, exploit requires placing guest orders.
- 8.8 /10 HighCVE-2026-111505 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting low privileged remote attackers execute arbitrary commands, exploit requires remote access.
- 7.2 /10 HighCVE-2026-111504 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an argument injection caused by improper neutralization of argument delimiters, letting high privileged remote attackers escalate privileges, exploit requires high privilege remote access.
- 7.1 /10 HighCVE-2026-111503 Auth required
Dell OpenManage Enterprise - SQL Injection
Dell OpenManage Enterprise < 4.8.0 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged remote attackers expose sensitive information, exploit requires low privileged remote access.
- 8.6 /10 HighCVE-2026-110972
Płatnik - Authentication Bypass
Płatnik 10.02.002 contains an authentication bypass caused by client-side authentication, letting attackers with access to any application instance authenticate as arbitrary users, exploit requires attacker access to application instance.
- 7.7 /10 HighCVE-2026-110971
Płatnik - Weak Cryptography
Płatnik software contains weak password encoding allowing users who obtain encoded passwords to easily decode them, letting attackers recover passwords, exploit requires access to encoded passwords.
- 9.8 /10 CriticalCVE-2026-110799 No auth
Vvveb - Authentication Bypass
Vvveb < 1.0.8.7 contains an authentication bypass caused by insufficient validation of user and token GET parameters in password reset functionality, letting attackers bypass authentication, exploit requires crafted password reset request.
- 7.5 /10 HighCVE-2026-110732 No auth
AI Engine – The Chatbot, AI Framework & MCP for WordPress - Broken Access Control
AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.6 contains a missing authorization vulnerability caused by an OAuth 2.1 Dynamic Client Registration endpoint with __return_true permission_callback, letting unauthenticated attackers register OAuth clients and gain admin-level control after consent, exploit requires administrator approval and clickjacking.