Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 367 of 767

  • 7.5 /10 High
    CVE-2014-125130 CISA KEVNo auth

    CodeArt Google MP3 Audio Player - Path Traversal

    CodeArt Google MP3 Audio Player plugin for WordPress through 1.0.11 contains a path traversal vulnerability caused by insufficient validation of the file parameter in direct_download.php, letting remote attackers read arbitrary files without authentication.

  • 8.2 /10 High
    CVE-2026-97662 No auth

    AWS security-agent-mcp-server - Arbitrary File Write

    AWS security-agent-mcp-server < 0.2.0 contains a file write vulnerability caused by argument injection in the diff scan operation, letting context-dependent threat actors create, overwrite, or truncate arbitrary files outside the intended workspace, exploit requires crafted reference value.

  • 7.2 /10 High
    CVE-2026-97661 No auth

    Business Essentials for Contact Form 7 - Stored XSS

    Business Essentials for Contact Form 7 WordPress plugin <= 1.2.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'gateway' form field, letting unauthenticated attackers execute arbitrary scripts, exploit requires Payments module enabled and form configured for PayPal and Stripe.

  • 7.6 /10 High
    CVE-2026-97297 Auth required

    Gratisfaction - Broken Access Control

    Gratisfaction <= 4.6.3 contains a broken access control vulnerability, letting attackers bypass authorization and access restricted resources, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-97284 Auth required

    Icegram - PHP Object Injection

    Icegram <= 3.1.31 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 7.6 /10 High
    CVE-2026-97277 Auth required

    Social Boost - Broken Access Control

    Social Boost <= 3.6.2 contains a broken access control vulnerability, letting attackers bypass authorization and access restricted resources, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-97273 No auth

    Premmerce Wishlist for WooCommerce - Reflected XSS

    Premmerce Wishlist for WooCommerce <= 1.1.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97268 No auth

    Premmerce Wishlist for WooCommerce - Reflected XSS

    Premmerce Wishlist for WooCommerce <= 1.1.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97260 No auth

    MaxGalleria - Reflected XSS

    MaxGalleria <= 6.5.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-96813 No auth

    Form Maker by 10Web - Stored XSS

    Form Maker by 10Web WordPress plugin <= 1.15.47 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Mark on Map Longitude/Latitude fields, letting unauthenticated attackers inject scripts executed on page access.

  • 9.1 /10 Critical
    CVE-2026-96659 Auth required

    Foreman - Broken Access Control

    Foreman contains an information disclosure and command execution vulnerability caused by insufficient access control in template preview endpoints, letting authenticated low-level Viewer users access sensitive data and execute commands under insecure configurations.

  • 9.9 /10 Critical
    CVE-2026-96658 Auth required

    Foreman - Remote Code Execution

    Foreman contains a remote code execution caused by improper handling of delegated methods in the templating engine, letting authenticated low-permission attackers bypass safemode sandbox and execute arbitrary commands.

  • 7.1 /10 High
    CVE-2026-96577

    oc-mirror - Broken Access Control

    oc-mirror contains an unrestricted network binding in the embedded local cache registry, letting unauthenticated adjacent network attackers push tampered images, delete cache, or access mirrored content, exploit requires network adjacency.

  • 7.2 /10 High
    CVE-2026-96573

    Appointment Hour Booking – Booking Calendar - Stored XSS

    Appointment Hour Booking – Booking Calendar WordPress plugin <= 1.5.97 contains a stored DOM-based cross-site scripting caused by insufficient input sanitization and output escaping in Booking Form Single-Line Field via Schedule Calendar List Renderer, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires 'list_readmore_numberofwords' setting configured with a positive integer.

  • 7.2 /10 High
    CVE-2026-96561 No auth

    AI Engine – The Chatbot, AI Framework & MCP for WordPress - Stored XSS

    AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.0 contains a stored cross-site scripting caused by improper input neutralization and output escaping in REST endpoint and dashboard widget, letting unauthenticated attackers execute arbitrary scripts in admin dashboard, exploit requires no authentication.