Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 357 of 767

  • 7.2 /10 High
    CVE-2026-96578 No auth

    GSpeech TTS – WordPress Text To Speech Plugin - Stored XSS

    GSpeech TTS – WordPress Text To Speech Plugin <= 3.22.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers execute arbitrary scripts when users access injected pages.

  • 7.2 /10 High
    CVE-2026-96567 No auth

    MW WP Form WordPress Plugin - Stored XSS

    MW WP Form WordPress plugin <= 5.1.7 contains a stored XSS caused by insufficient sanitization and escaping of the 'post_id' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-96566 No auth

    The Newsletter WordPress Plugin - Stored XSS

    The Newsletter WordPress plugin <= 9.4.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'np1' custom field parameter, letting unauthenticated attackers inject scripts executed when users access injected pages, exploit requires no authentication or capability checks.

  • 7.2 /10 High
    CVE-2026-95817 No auth

    DoFollow Case by Case WordPress plugin - Stored XSS

    DoFollow Case by Case WordPress plugin <= 3.6.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers execute arbitrary scripts in users' browsers, exploit requires administrator approval of malicious comments.

  • 7.2 /10 High
    CVE-2026-95670 No auth

    No External Links WordPress plugin - Stored XSS

    No External Links WordPress plugin <= 5.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in /goto/{base64} redirect, letting unauthenticated attackers execute arbitrary scripts, exploit requires 'Link Encoding: Base64' option enabled.

  • 9.4 /10 Critical
    CVE-2026-95102 No auth

    WebSocket Endpoints - Authentication Bypass

    WebSocket endpoints contain a broken authentication caused by lack of proper authentication mechanisms, letting attackers impersonate charging stations and gain unauthorized access, exploit requires no authentication.

  • 8.2 /10 High
    CVE-2026-94653 No auth

    Apache Thrift - Denial of Service

    Apache Thrift PHP bindings before 0.25.0 contain an inefficient algorithmic complexity vulnerability caused by suboptimal algorithm implementation, letting attackers cause denial of service via resource exhaustion, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-94651 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains a resource management vulnerability caused by improper handling of exceptional conditions in Java bindings, letting attackers cause resource exhaustion, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-94648 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability in dart bindings, letting attackers cause denial of service by exhausting resources, exploit requires no special privileges.

  • 8.2 /10 High
    CVE-2026-94645 No auth

    Apache Thrift - Denial of Service

    Apache Thrift < 0.25.0 contains an allocation of resources without limits or throttling vulnerability caused by improper validation of specified quantity in Node.js bindings, letting attackers cause resource exhaustion, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-94644 No auth

    Apache Thrift - Denial of Service

    Apache Thrift PHP bindings before 0.25.0 contain an allocation of resources without limits or throttling vulnerability, letting attackers cause denial of service by exhausting resources, exploit requires no special privileges.

  • 8.7 /10 High
    CVE-2026-94642 No auth

    Apache Thrift - Uncaught Exception

    Apache Thrift < 0.25.0 contains an uncaught exception vulnerability in PHP bindings, letting attackers cause unexpected application behavior, exploit requires crafted input triggering the exception.

  • 8.2 /10 High
    CVE-2026-94639 No auth

    Apache Thrift - Denial of Service

    Apache Thrift before 0.25.0 contains an uncaught exception vulnerability caused by improper handling of exceptional conditions and resource allocation without limits in Java bindings, letting attackers cause denial of service, exploit requires crafted input.

  • 8.2 /10 High
    CVE-2026-94637 No auth

    Apache Thrift - Denial of Service

    Apache Thrift Go bindings before 0.25.0 contain an improper handling of highly compressed data vulnerability caused by data amplification, letting attackers potentially cause denial of service, exploit requires crafted compressed data.

  • 7.8 /10 High
    CVE-2026-94593

    Armatura One - Information Disclosure

    Armatura One contains an information disclosure caused by logging the full database connection command including superuser password in plain text, letting attackers with OS access retrieve credentials, exploit requires OS access.