Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 358 of 767

  • 8.4 /10 High
    CVE-2026-94592

    Armatura One - Authentication Bypass

    Armatura One contains a broken authentication caused by use of a fixed vendor-defined password for the database superuser account, letting attackers with OS access authenticate as superuser, exploit requires OS access and knowledge of the password.

  • 8.4 /10 High
    CVE-2026-94591

    Armatura One - Information Disclosure

    Armatura One contains a cryptographic weakness caused by fixed AES-128-CBC encryption key and IV embedded in the software, letting attackers decrypt stored database and message-broker credentials, exploit requires access to installation package and encrypted config file.

  • 9.8 /10 Critical
    CVE-2026-94541 PoC public

    WPMobile.App - Authorization Bypass

    WPMobile.App – Android and iOS App Builder plugin for WordPress <= 11.82 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers exfiltrate password-reset URLs and take over accounts, exploit requires mail-to-push feature enabled.

  • 8.8 /10 High
    CVE-2026-94422 No auth

    xdg-dbus-proxy - Remote Code Execution

    xdg-dbus-proxy < 0.1.9 contains a bypass of message filtering caused by improper handling of reply serial numbers on non-reply messages, letting malicious Flatpak apps execute arbitrary code outside their sandbox, exploit requires malicious or compromised Flatpak app.

  • 7.2 /10 High
    CVE-2026-93875 No auth

    JetAppointment WordPress Plugin - Stored XSS

    JetAppointment WordPress plugin <= 2.5.2.1 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'friendlyTime' parameter, letting unauthenticated attackers inject scripts executed in admin browser, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-93756 No auth

    Smash Balloon Social Post Feed - Stored Cross-Site Scripting & Remote Code Execution

    Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin <= 4.13.0 contains a stored XSS caused by insufficient input sanitization and output escaping in Facebook Comment Message via v-html in Admin Builder Preview, letting unauthenticated attackers inject scripts executing on admin feed builder preview, exploit requires attacker to have a Facebook account to post comments.

  • 9.9 /10 Critical
    CVE-2026-93698 Auth required

    Multilang - Command Injection

    Multilang contains a command injection caused by insufficient validation in adminbin, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

  • 9.0 /10 Critical
    CVE-2026-93697 Auth required

    WHM Mass Modify Accounts - Stored XSS

    WHM Mass Modify Accounts interface contains a stored XSS vulnerability caused by improper input sanitization, letting attackers execute arbitrary scripts, exploit requires user interaction.

  • 7.2 /10 High
    CVE-2026-93367 No auth

    Visitors Traffic Real Time Statistics Pro - Stored XSS

    Visitors Traffic Real Time Statistics Pro WordPress plugin <= 11.22 contains a stored XSS caused by unsanitized 'page_title' parameter in ahcpro_track_visitor AJAX action, letting unauthenticated attackers execute arbitrary JavaScript in admin sessions.

  • 9.0 /10 Critical
    CVE-2026-93029 Auth required

    WHM Manage SSL Hosts - Stored XSS

    WHM Manage SSL Hosts contains a stored XSS vulnerability caused by improper input sanitization, letting attackers execute arbitrary scripts on users, exploit requires user interaction.

  • 8.1 /10 High
    CVE-2026-92820 No auth

    Ninja Forms - File Uploads - Arbitrary File Operations

    Ninja Forms - File Uploads plugin for WordPress <= 3.3.34 contains arbitrary file operations caused by unvalidated attacker-supplied file paths in the external Amazon S3 upload flow, letting unauthenticated attackers read, write, or delete arbitrary files, exploit requires External File Upload action and Email action for read.

  • 7.5 /10 High
    CVE-2026-92174 Auth required

    SiteOrigin Widgets Bundle - Local File Inclusion

    SiteOrigin Widgets Bundle plugin for WordPress <= 1.73.2 contains a local file inclusion caused by improper validation of the 'theme' parameter in /wp-json/sowb/v1/widgets/previews, letting authenticated contributors include and execute arbitrary PHP files, exploit requires crafted widgetData payload with legacy theme key and non-empty columns array.

  • 7.5 /10 High
    CVE-2026-91828 No auth

    OMGF WordPress Plugin - Denial of Service

    OMGF WordPress plugin < 6.3.11 contains a denial of service caused by unauthenticated slow server-side loopback requests, letting unauthenticated attackers exhaust PHP worker pool and make the site unavailable, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-90970 PoC publicAuth required

    GitLab AI Gateway - Command Injection

    GitLab AI Gateway 18.1.6 < 19.2.4, 19.3 < 19.3.2, and 19.4 < 19.4.1 contain a command injection caused by sandbox escape via specially crafted flow configuration in prompt template, letting authenticated users with Duo Agent Platform access execute arbitrary commands, exploit requires Duo Agent Platform access.

  • 7.2 /10 High
    CVE-2026-90438 No auth

    Ninja Forms - Stored Cross-Site Scripting

    Ninja Forms WordPress plugin <= 3.15.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Paragraph Text (RTE) field, letting unauthenticated attackers inject scripts executed on user page access, exploit requires RTE enabled on Paragraph Text field.