Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 34 of 891
- 7.5 /10 HighCVE-2026-110305 No auth
Advanced Custom Fields: Extended - Sensitive Information Exposure
Advanced Custom Fields: Extended plugin for WordPress <= 0.9.2.7 contains a sensitive information exposure caused by injection of {get_user} template tag in process component, letting unauthenticated attackers extract sensitive data including WordPress password hashes, exploit requires administrator configuration of public [acfe_form] shortcode page with Term action using save.name field mapping.
- 7.5 /10 HighCVE-2026-107630 No auth
Email Templates Customizer and Designer for WordPress and WooCommerce - Authorization Bypass
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers enumerate order IDs and exfiltrate customer PII, exploit requires two unauthenticated requests with nonce harvesting.
- 9.8 /10 CriticalCVE-2026-107249 No auth
Drupal Block AJAX - Insecure Deserialization
Drupal Block AJAX <= 3.0.2 contains an object injection vulnerability caused by improperly controlled modification of dynamically-determined object attributes, letting attackers inject malicious objects remotely, exploit requires crafted request.
- 8.8 /10 HighCVE-2026-105894 Auth required
Ak Framework WordPress Plugin - Privilege Escalation
Ak Framework plugin for WordPress <= 2.9.8 contains a privilege escalation caused by missing capability checks in ajax_refresh_nonce and ak_admin_ajax handlers, letting unauthenticated attackers update arbitrary options to escalate privileges.
- 7.1 /10 HighCVE-2026-105077 No auth
Ad Inserter - Reflected XSS
Ad Inserter <= 2.8.19 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-104744 No auth
Independent Analytics Pro WordPress Plugin - Stored XSS
Independent Analytics Pro WordPress plugin <= 2.15.5 contains a stored XSS caused by insufficient sanitization and escaping of 'utm_campaign' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires plugin active and attacker to obtain a server-signed payload.
- 7.9 /10 HighCVE-2026-104615 Auth required
SUSE Rancher Fleet - Broken Access Control
SUSE Rancher Fleet < 0.12, 0.13.0 to 0.13.17, 0.14.0 to 0.14.12, 0.15.0 to 0.15.17, and 0.16.0 to 0.16.3 contains a broken access control caused by accepting cluster identity without binding to the registration token, letting attackers associate registration requests with clusters registered with different tokens, exploit requires crafted registration request.
- 8.8 /10 HighCVE-2026-104368 Auth required
WordPress Export and Import Users and Customers - Privilege Escalation
WordPress Export and Import Users and Customers plugin <= 2.7.5 contains a privilege escalation caused by CSV escape-character mismatch between export and import components, letting authenticated subscribers create arbitrary administrator accounts, exploit requires subscriber-level access.
- 7.8 /10 HighCVE-2026-104067 No auth
Scribus - Out of Bounds Read/Write
Scribus < 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin caused by failure to verify bitmap and transparency mask dimensions, letting attackers trigger heap reads/writes and potential code execution as the user, exploit requires crafted SVM file.
- 7.8 /10 HighCVE-2026-104066 No auth
Scribus - Buffer Overflow
Scribus < 1.6.7 contains a heap buffer overflow caused by improper unpacking of 4-bit indexed pixel data in the Mac PICT image loader and import plugin, letting attackers execute code or cause crashes via crafted PICT files, exploit requires user to place or import crafted files.
- 7.8 /10 HighCVE-2026-104065 No auth
Scribus - Buffer Overflow
Scribus < 1.6.7 contains a buffer overflow caused by unvalidated y offset in importdrw Micrografx Draw plugin, letting attackers execute code or cause crashes by importing crafted DRW files, exploit requires user to import malicious file.
- 7.8 /10 HighCVE-2026-104064 No auth
Scribus - Integer Overflow
Scribus < 1.6.7 contains an integer overflow caused by improper handling of tile dimensions in the scimgdataloader_tiff TIFF loader, letting attackers trigger heap overflow to crash or execute code, exploit requires user to import crafted TIFF.
- 7.8 /10 HighCVE-2026-104062 No auth
Scribus - Buffer Overflow
Scribus < 1.6.7 contains a heap buffer overflow caused by unchecked bytesPerLine value in the PICT image loader and import plugin, letting attackers execute code as the user by crafting malicious PICT files.
- 7.8 /10 HighCVE-2026-104061 No auth
Scribus - Out of Bounds Read/Write
Scribus < 1.6.7 contains a heap out-of-bounds write caused by unchecked PSD file values in scimgdataloader_psd loader, letting attackers cause crashes or execute code by convincing users to import crafted PSD files.
- 7.5 /10 HighCVE-2026-103963
glib-networking - Denial of Service
glib-networking contains a denial of service caused by unbounded client-side TLS 1.3 session ticket caching, letting malicious servers exhaust client memory, exploit requires connection to a malicious server.