Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 349 of 767

  • 7.5 /10 High
    CVE-2026-104712 No auth

    Apache Struts - Denial of Service

    Apache Struts 2.5.14 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain an asymmetric resource consumption vulnerability caused by binding request parameters to BigDecimal properties rendered via Struts tag library, letting unauthenticated remote attackers exhaust server CPU and network capacity, exploit requires binding and rendering of BigDecimal properties.

  • 9.8 /10 Critical
    CVE-2026-104711 PoC public

    Apache Struts - Expression Language Injection

    Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 contain an expression language injection caused by improper neutralization of OGNL expressions in legacy RESTful action mapper, letting remote attackers execute arbitrary code, exploit requires legacy RESTful action mapper and OGNL allowlist disabled.

  • 8.4 /10 High
    CVE-2026-104706 Auth required

    DigitalCanion Portal - Path Traversal

    DigitalCanion portal contains a path traversal vulnerability caused by improper input validation in Administration -> View Logs menu, letting remote attackers view or download sensitive system files, exploit requires network access.

  • 7.6 /10 High
    CVE-2026-104408 Auth required

    Groundhogg Groundhogg - SQL Injection

    Groundhogg Groundhogg <= 4.8.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-104407 No auth

    Blubrry Podcasting PowerPress Podcasting - Cross-Site Request Forgery

    Blubrry Podcasting PowerPress Podcasting <= 11.17.9 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 8.5 /10 High
    CVE-2026-104389 Auth required

    Sirv Sirv - SQL Injection

    Sirv Sirv <= 8.2.5 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.

  • 9.5 /10 Critical
    CVE-2026-103510 No auth

    P4 Search - Authentication Bypass

    P4 Search < 2026.4.2 contains a broken authentication caused by failure to securely handle blank service authentication tokens, letting unauthenticated attackers with network access gain highest application privileges.

  • 7.5 /10 High
    CVE-2026-103507 Auth required

    Perforce P4 Search - Unrestricted File Upload

    Perforce P4 Search < 2026.4.2 contains an unrestricted file write vulnerability caused by insufficient path restrictions in the logging configuration interface, letting attackers with service authentication token write arbitrary files, exploit requires service authentication token.

  • 9.3 /10 Critical
    CVE-2026-103352 No auth

    WP BASE Booking - SQL Injection

    WP BASE Booking <= 6.4.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-103349 Auth required

    Rymera Web Co Product Feed PRO for WooCommerce - Insecure Deserialization

    Rymera Web Co Product Feed PRO for WooCommerce <= 13.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-103348 Auth required

    Smackcoders Inc. WP Ultimate Exporter - Insecure Deserialization

    Smackcoders Inc. WP Ultimate Exporter <= 3.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-103334 No auth

    Etoile Web Design Incorporated Five Star Restaurant Reservations - Information Disclosure

    Etoile Web Design Incorporated Five Star Restaurant Reservations <= 2.7.24 contains an insertion of sensitive information into sent data vulnerability, letting attackers retrieve embedded sensitive data, exploit requires crafted input.

  • 8.5 /10 High
    CVE-2026-103066 Auth required

    WP BASE Booking - SQL Injection

    WP BASE Booking <= 6.4.0 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-102780 No auth

    Joomla Extension joomlafry.com - Broken Access Control

    Joomla Extension joomlafry.com 2.9.0 - 2.9.4 contains an unauthenticated cross-record publication and mass assignment vulnerability caused by unfiltered raw jform data in RecordController, letting guest attackers modify any TF Content record including published, access, and created_by fields, exploit requires obtaining a valid token from Joomla's public login form.

  • 7.5 /10 High
    CVE-2026-102775 No auth

    Phoca Cart - Authorization Bypass

    Phoca Cart 5.0.0 - 6.1.8 contains an authorization bypass caused by lack of proper verification of download tokens in the order-file download endpoint, letting remote attackers download any customer's digital goods by supplying arbitrary tokens, exploit requires no authentication.