Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 366 of 767

  • 7.3 /10 High
    CVE-2026-103552 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API >= 1.2.0 < 1.2.9 contains a stack overflow caused by processing deeply nested search filters in the server's decoder, letting remote attackers cause denial of service, exploit requires sending crafted nested filters.

  • 7.2 /10 High
    CVE-2026-103426 No auth

    Relevanssi Premium WordPress - Stored XSS

    Relevanssi Premium WordPress plugin <= 2.31.4 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the '_rt' parameter, letting unauthenticated attackers inject scripts executed on user page access, exploit requires click-tracking and logging enabled.

  • 7.5 /10 High
    CVE-2026-103098

    Generic Application - Information Disclosure

    An application transmits a sensitive key in the URL over an unencrypted HTTP connection, letting attackers intercept the key via network traffic, exploit requires network access to monitor traffic.

  • 7.5 /10 High
    CVE-2026-103097 No auth

    Android Application - Hardcoded Credentials

    An Android application contains hardcoded API keys retrievable from the application package, letting unauthorized users extract and misuse sensitive credentials, exploit requires reverse engineering the app.

  • 7.5 /10 High
    CVE-2026-103096 No auth

    Android Application - Hardcoded Credentials

    An Android application contains a hardcoded API key in the application package, allowing attackers who reverse engineer the app to retrieve and misuse the key, exploit requires access to the application package.

  • 9.3 /10 Critical
    CVE-2026-102795 No auth

    Apache Traffic Server - Broken Access Control

    Apache Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 contains an improper access control vulnerability caused by flawed authorization checks, letting attackers bypass access restrictions, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-102772 No auth

    CMB2 WordPress Plugin - Stored Cross-Site Scripting

    CMB2 WordPress plugin <= 2.13.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in '<textarea_code field id>' parameter, letting unauthenticated attackers inject scripts executed by users, exploit requires public exposure of CMB2 form with textarea_code field.

  • 7.5 /10 High
    CVE-2026-102731 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API 1.2.0 to < 1.2.9 contains a denial of service caused by excessive memory allocation from small BER-encoded responses, letting attackers cause OutOfMemoryError and service disruption, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-102565 No auth

    BA Book Everything WordPress Plugin - Stored XSS

    BA Book Everything WordPress plugin <= 1.8.28 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'booking_service_qty' parameter, letting unauthenticated attackers inject scripts executed by admin users, exploit requires admin to view injected order.

  • 7.7 /10 High
    CVE-2026-101104 Auth required

    Meari IoT Cloud Platform - Broken Access Control

    Meari IoT Cloud Platform OpenAPI Service contains an authorization flaw caused by improper ownership verification, letting authenticated users manipulate configurations of devices they do not own, exploit requires user authentication.

  • 7.2 /10 High
    CVE-2026-10026 Auth required

    CTX Feed Pro WordPress - Code Injection

    CTX Feed Pro WordPress plugin <= 7.6.12 contains a code injection caused by insufficient input validation on the 'Feed Config' field passed to eval(), letting authenticated administrators execute arbitrary PHP code on the server.

  • 7.2 /10 High
    CVE-2026-100182 No auth

    Download Monitor WordPress Plugin - Stored XSS

    Download Monitor WordPress plugin <= 5.2.10 contains a stored XSS caused by insufficient input sanitization and output escaping in postMessage to Admin Editor, letting unauthenticated attackers inject scripts via tricking an admin, exploit requires admin interaction.

  • 7.2 /10 High
    CVE-2026-100107 No auth

    Kubio AI Page Builder - Stored XSS

    Kubio AI Page Builder WordPress plugin <= 2.9.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject scripts executed on page access.

  • 9.8 /10 Critical
    CVE-2023-54405 CISA KEVNo auth

    H3C CVM - Unrestricted File Upload

    H3C CVM contains an unauthenticated arbitrary file upload vulnerability caused by insufficient validation of the token parameter in /cas/fileUpload/upload, letting remote attackers upload malicious files and achieve remote code execution, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2020-37278 CISA KEVNo auth

    Weaver e-Bridge - Arbitrary File Read & Server-Side Request Forgery

    Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability caused by improper validation of the downloadUrl parameter in the saveYZJFile endpoint, letting remote attackers read sensitive files and perform server-side request forgery, exploit requires no authentication.