Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 35 of 677
- 8.8 /10 HighCVE-2026-104795 Auth required
Insights-runtime-extractor - Privilege Escalation
Insights-runtime-extractor DaemonSet contains a privilege escalation caused by insufficient privilege drop and execution of workload-controlled binaries, letting any tenant scheduling a pod escalate to root on the node, exploit requires scheduling a pod with a malicious binary.
- 7.5 /10 HighCVE-2026-104767 Auth required
Membership & User Roles for WooCommerce - Privilege Escalation
Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress <= 20260828 contains a privilege escalation caused by improper validation of cached foreign roles in maybe_add_role_to_user(), letting authenticated subscribers restore revoked Administrator roles, exploit requires Replace Roles mode enabled and prior legitimate Administrator role assignment.
- 7.2 /10 HighCVE-2026-104764 Auth required
Post Export Import with Media WordPress plugin - Insecure Deserialization
Post Export Import with Media WordPress plugin <= 1.17.1 contains a PHP Object Injection caused by deserialization of untrusted input, letting authenticated administrators inject PHP objects, exploit requires presence of a POP chain in other plugins or themes.
- 7.5 /10 HighCVE-2026-104749 No auth
Bit integrations WordPress plugin - Privilege Escalation
Bit integrations WordPress plugin <= 2.10.6 contains a privilege escalation caused by log re-execution vulnerability in IntegrationHandler and LogHandler components, letting unauthenticated attackers overwrite administrator passwords, exploit requires admin to configure user_pass mapping and re-execute log.
- 9.8 /10 CriticalCVE-2026-104748 PoC publicNo auth
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications - Privilege Escalation
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin <= 3.10.0 contains a privilege escalation caused by missing capability checks in wp_ajax_nopriv_simpleform_wp_register and improper meta writing, letting unauthenticated attackers create administrator accounts, exploit requires nonce from front-end JavaScript.
- 8.7 /10 HighCVE-2026-104143 Auth required
DataEase - SQL Injection
DataEase < 2.10.26 contains a SQL injection caused by lack of validation of custom dateFormat in dataset fields, letting authenticated users alter generated SQL and compromise backend database, exploit requires user authentication.
- 8.7 /10 HighCVE-2026-104142 Auth required
DataEase - SQL Injection
DataEase < 2.10.26 contains a stored SQL injection caused by unvalidated insertion of crafted FieldGroupDTO values into CASE expressions in dataset group-field binning, letting authenticated users execute unparameterized backend queries, exploit requires authentication.
- 8.7 /10 HighCVE-2026-104141 Auth required
DataEase - SQL Injection
DataEase contains a SQL injection caused by insertion of crafted schema, username, table, or database names into metadata queries via CalciteProvider using plain JDBC Statement, letting authenticated users with datasource access execute arbitrary SQL, exploit requires authenticated datasource access.
- 8.1 /10 HighCVE-2026-104108 No auth
FileRise - Authentication Bypass
FileRise < 3.23.0 contains an authentication bypass caused by mapping mutable OIDC preferred_username or email claims to local accounts without requiring email verification, letting attackers log in as existing users including admin, exploit requires attacker to obtain colliding provider-issued claims.
- 8.1 /10 HighCVE-2026-104103 No auth
Ludwig - Path Traversal
Ludwig < 0.17.8 contains a path traversal caused by improper validation of symlink and hard-link members in tar archives during extraction, letting attackers place files outside extraction directory, exploit requires user to process attacker-controlled archive on Python 3.12 or 3.13.
- 8.8 /10 HighCVE-2026-103994 No auth
Juniper Networks Junos OS - Heap-based Buffer Overflow
Juniper Networks Junos OS contains a heap-based buffer overflow caused by improper handling in VXLAN Gateway Daemon (vgd), letting malicious or compromised SDN-controller cause outage or remote code execution, exploit requires malicious SDN-controller.
- 8.1 /10 HighCVE-2026-103977 PoC publicAuth required
FileRise - Authentication Bypass
FileRise < 3.23.0 contains a broken authentication caused by storing failed TOTP attempts in session instead of account-wide, letting attackers with valid primary credentials bypass second-factor attempt limits, exploit requires valid primary credentials.
- 8.3 /10 HighCVE-2026-103946 Auth required
Nessus - SQL Injection
Nessus contains an SQL injection caused by improper input sanitization, letting authenticated users read or modify stored data, exploit requires user authentication.
- 7.8 /10 HighCVE-2026-103929 No auth
mise - Command Injection
mise prior to 2026.7.14 contains a command injection caused by loading untrusted .mise.toml settings before trust approval, letting attackers execute commands with developer privileges, exploit requires untrusted local project configuration.
- 7.5 /10 HighCVE-2026-103905 No auth
JTL-Shop - Broken Access Control
JTL-Shop administration backend contains a broken access control vulnerability caused by processing the plugin safe mode toggle before authentication, letting unauthenticated remote attackers toggle plugin safe mode causing denial of service, exploit requires no authentication.