Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 36 of 677
- 9.3 /10 CriticalCVE-2026-103904 No auth
JTL-Shop - Stored XSS
JTL-Shop contains a stored XSS vulnerability caused by lack of validation and output encoding of arbitrary consent names in the public consent endpoint, letting unauthenticated remote attackers execute script code in administrator sessions, exploit requires administrator to view consent statistics page.
- 7.5 /10 HighCVE-2026-103423 No auth
Booking Package WordPress Plugin - Authorization Bypass
Booking Package WordPress plugin <= 1.7.29 contains an authorization bypass caused by improper user authorization verification in booking_package_booked_customers endpoint, letting unauthenticated attackers retrieve PII, exploit requires nonce token exposure via shortcode or widget.
- 7.2 /10 HighCVE-2026-103422 No auth
AnyComment WordPress Plugin - Stored XSS
AnyComment WordPress plugin <= 0.3.6 contains a stored cross-site scripting caused by insufficient input sanitization and missing output escaping in the email parameter on /wp-json/anycomment/v1/subscribe, letting unauthenticated attackers inject scripts executed when admins view subscriptions.
- 9.3 /10 CriticalCVE-2026-103415 No auth
TLS 1.3 Client - Buffer Overflow
TLS 1.3 clients copy the server's cookie from HelloRetryRequest into the second ClientHello without validating cookie size, causing a buffer overflow before certificate authentication, letting malicious servers overwrite memory.
- 8.4 /10 HighCVE-2026-103414 No auth
GUIX - Buffer Overflow
GUIX contains a buffer overflow caused by improper validation of gx_page_header_data_size during binary resource theme loading, letting attackers write past allocated memory, exploit requires crafted resource file.
- 8.1 /10 HighCVE-2026-103367 No auth
ShopMagic WordPress Plugin - Local File Inclusion
ShopMagic – email automation for WordPress plugin for WordPress <= 4.9.0 contains a local file inclusion caused by improper handling of 'billing_address.first_name' parameter, letting unauthenticated attackers execute arbitrary PHP files, exploit requires a published recipe processing {{ customer.first_name }} placeholder.
- 7.5 /10 HighCVE-2026-103366 No auth
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress - Broken Access Control
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress up to 5.7.3 contains an insecure direct object reference caused by lack of ownership checks in booking and cart ID parameters, letting unauthenticated attackers read other users' appointment and cart details via public AJAX routes.
- 7.5 /10 HighCVE-2026-103358 No auth
VillaTheme Email Template Customizer for WooCommerce - Code Injection
VillaTheme Email Template Customizer for WooCommerce <= 1.3.4 contains a code injection vulnerability caused by improper control of code generation, letting attackers inject and execute arbitrary code, exploit requires crafted input.
- 8.6 /10 HighCVE-2026-103307 No auth
Walletdoc Payment Gateway for WooCommerce - SQL Injection & Authentication Bypass
Walletdoc Payment Gateway for WooCommerce WordPress plugin < 1.8.5 contains a SQL injection caused by improper sanitization and empty default signing secret in payment webhook verification, letting unauthenticated attackers perform SQL injection and mark arbitrary orders as paid, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-103081 No auth
VillaTheme Salevo woo-boost-sales - Code Injection
VillaTheme Salevo woo-boost-sales <= 1.3.0 contains a code injection vulnerability caused by improper control of code generation, letting attackers inject and execute arbitrary code, exploit requires crafted input.
- 8.1 /10 HighCVE-2026-102986 Auth required
Plane - Broken Access Control
Plane <= 1.3.1 contains a broken access control vulnerability caused by lack of workspace or project membership verification in EntityAssetEndpoint at /api/public/assets/v2/anchor/{anchor}, letting authenticated users create or soft-delete FileAsset records across workspaces, exploit requires authentication.
- 7.5 /10 HighCVE-2026-102944 No auth
cpp-httplib - Information Disclosure
cpp-httplib < 0.51.0 contains an information disclosure vulnerability caused by improper handling of Cookie headers during cross-origin redirects, letting attackers intercept session cookies, exploit requires attacker control of redirect response or network position on non-HTTPS origin.
- 7.6 /10 HighCVE-2026-102899 No auth
Sentry - Authentication Bypass
Sentry 26.5.0 to 26.7.2 contains an authentication bypass caused by SAML SSO identity-linking flow allowing attacker-controlled SAML IdP to link attacker identity to victim account, letting attackers take control of victim accounts, exploit requires victim to open malicious URL with permissive cookie settings.
- 9.1 /10 CriticalCVE-2026-102893 No auth
Zulip Server - Authentication Bypass
Zulip Server <= 12.1 contains an authentication bypass caused by GenericOpenIdConnectBackend not rejecting false email_verified claims, letting attackers log into accounts with unverified emails, exploit requires misconfigured trusted identity provider.
- 9.2 /10 CriticalCVE-2026-102748 No auth
Dgraph - Broken Access Control
Dgraph Zero < 25.4.0 contains an unauthenticated access vulnerability caused by administrative HTTP routes on port 6080 without authentication, letting remote attackers disrupt the Zero control plane and destabilize Alpha nodes, exploit requires access to Zero HTTP port.