Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 380 of 767

  • 9.1 /10 Critical
    CVE-2026-97196 No auth

    Liquid Web / StellarWP GiveWP - Authentication Bypass

    Liquid Web / StellarWP GiveWP <= 4.16.9 contains an authentication bypass caused by improper validation of unsafe equivalence in input, letting attackers bypass authentication, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-97150 Auth required

    baserCMS BcAddonMigrator - File Inclusion

    baserCMS BcAddonMigrator contains an arbitrary file read and deletion vulnerability caused by inclusion and execution of addon config.php files, letting administrative users read or delete arbitrary files, exploit requires administrative privileges.

  • 7.1 /10 High
    CVE-2026-97077 No auth

    Ad Inserter - Reflected XSS

    Ad Inserter <= 2.8.18 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-97065 No auth

    Happyforms - Reflected XSS

    Happyforms <= 1.26.15 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-96838 No auth

    Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification - Cross Site Request Forgery

    Blacklist Manager - WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 contains an unauthenticated cross site request forgery caused by lack of proper request validation, letting unauthenticated attackers perform unauthorized actions, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-96837 Auth required

    CartFlows - Remote Code Execution

    CartFlows <= 3.2.0 contains a remote code execution caused by improper input handling, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 7.1 /10 High
    CVE-2026-96836 No auth

    Parsi Date - Stored XSS

    Parsi Date <= 6.3 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-96833 Auth required

    Ultimate Addons for Contact Form 7 - PHP Object Injection

    Ultimate Addons for Contact Form 7 <= 3.5.51 contains a PHP object injection caused by unsafe deserialization in the Editor component, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-96832 Auth required

    Content Egg - PHP Object Injection

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-96831 Auth required

    Themify Builder - PHP Object Injection

    Themify Builder <= 7.8.1 contains a PHP Object Injection caused by unsafe unserialize usage, letting attackers inject arbitrary objects, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-96830 No auth

    GiveWP - Reflected XSS

    GiveWP <= 4.16.9 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute arbitrary scripts, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-96828 Auth required

    Category Discount WooCommerce - SQL Injection

    Category Discount WooCommerce <= 5.18 contains an SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.

  • 7.6 /10 High
    CVE-2026-96827 Auth required

    Admin Notices Manager - SQL Injection

    Admin Notices Manager <= 1.6.0 contains a SQL injection caused by improper sanitization of administrator inputs, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.

  • 7.5 /10 High
    CVE-2026-96823 No auth

    WooCommerce - Broken Access Control

    WooCommerce <= 5.120.0 contains an unauthenticated arbitrary content deletion vulnerability in customer reviews, letting unauthenticated attackers delete review content remotely, exploit requires no authentication.

  • 9.3 /10 Critical
    CVE-2026-96822 No auth

    Books Gallery - SQL Injection

    Books Gallery <= 4.8.3 contains an SQL injection caused by unsanitized input in database queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.