Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 35 of 891
- 9.8 /10 CriticalCVE-2026-103039 CISA KEVPoC publicNo auth
Gravity Forms - Insecure Deserialization
Gravity Forms plugin for WordPress <= 3.1.2 contains a PHP Object Injection caused by unsafe unserialization in GFFormsModel::create_post(), letting unauthenticated attackers inject PHP objects into post meta, exploit requires presence of vulnerable gadget chains in plugins/themes or WordPress environment.
- 7.2 /10 HighCVE-2026-101214 Auth required
Dell OpenManage Enterprise - OS Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privileges.
- 7.8 /10 HighCVE-2026-101213 Auth required
Dell OpenManage Enterprise - Privilege Escalation
Dell OpenManage Enterprise < 4.8.0 contains an improper privilege management vulnerability, letting low privileged local attackers escalate their privileges, exploit requires local access with low privileges.
- 7.2 /10 HighCVE-2026-101210 Auth required
Dell OpenManage Enterprise - Command Injection
Dell OpenManage Enterprise < 4.8.0 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands, exploit requires high privileges.
- 8.7 /10 HighCVE-2025-8574 Auth required
Database Cleaner WordPress plugin - Broken Access Control
Database Cleaner WordPress plugin <= 1.4.7 contains a broken access control vulnerability caused by lack of restriction on deletable database tables, letting authenticated administrators delete core WordPress tables.
- 8.4 /10 HighCVE-2025-68394 Auth required
ARKETEAM Protectel - SQL Injection
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a sql injection caused by improper neutralization of input in the "profilInput" parameter, letting low privileged users execute arbitrary SQL commands.
- 8.4 /10 HighCVE-2025-68393 Auth required
ARKETEAM Protectel - SQL Injection
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a SQL injection caused by improper neutralization of input in the "Utilisateur" parameter, letting low privileged users execute arbitrary SQL commands.
- 9.8 /10 CriticalCVE-2025-31704 CISA KEVNo auth
Dahua Intelligent Connection Center - Command Injection
Dahua Intelligent Connection Center contains a command injection caused by processing of specially crafted requests, letting remote attackers execute arbitrary commands, exploit requires network access.
- 7.5 /10 HighCVE-2010-20125 CISA KEVNo auth
DedeCMS - File Inclusion
DedeCMS < 5.7 contains a file inclusion vulnerability caused by uninitialized 'code' parameter in plus/carbuyaction.php, letting remote unauthenticated attackers include arbitrary local files via path traversal.
- 9.8 /10 CriticalCVE-2026-97854 No auth
Yamaha NWR100 - Command Injection
Yamaha wireless LAN router NWR100 contains a command injection caused by improper input validation, letting attackers execute arbitrary OS commands remotely, exploit requires sending a specially crafted request.
- 7.2 /10 HighCVE-2026-96767 No auth
NEX-Forms – Ultimate Forms Plugin for WordPress - Stored XSS
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.3.2 contains a stored XSS caused by insufficient input sanitization and output escaping in the 'type' parameter, letting unauthenticated attackers inject scripts executed on user page access.
- 7.2 /10 HighCVE-2026-96741 No auth
DSGVO All in one for WP - Stored XSS
DSGVO All in one for WP plugin for WordPress <= 5.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts executed on user page access, exploit requires admin approval of crafted comment with specific plugin options enabled.
- 7.2 /10 HighCVE-2026-96669 No auth
The Food Store – Online Food Delivery & Pickup - Stored XSS
The Food Store – Online Food Delivery & Pickup WordPress plugin <= 1.5.5 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'service_type' cookie, letting unauthenticated attackers inject scripts executed in admin panel, exploit requires injecting payload via public checkout page.
- 7.2 /10 HighCVE-2026-96666 No auth
Schema App Structured Data WordPress Plugin - Stored XSS
Schema App Structured Data WordPress plugin <= 2.3.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'Remove Microdata' output filter, letting unauthenticated attackers inject scripts executed by users, exploit requires admin to enable 'Remove Microdata' and approve malicious comment.
- 8.1 /10 HighCVE-2026-96228 No auth
SSL Wireless SMS Notification for WordPress - Authentication Bypass
SSL Wireless SMS Notification for WordPress <= 3.8.1 contains an authentication bypass caused by improper verification of SMS OTP and server-side state in final_login_ajax_action, letting unauthenticated attackers take over accounts by knowing phone numbers.