Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 382 of 767

  • 7.2 /10 High
    CVE-2026-96344 Auth required

    eCommerce Product Catalog - PHP Object Injection

    eCommerce Product Catalog <= 3.6.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code via crafted objects, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-96343 Auth required

    WP ERP - PHP Object Injection

    WP ERP <= 1.17.9 contains a PHP Object Injection caused by unsafe handling of custom roles, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-95616 No auth

    WSS4J - Denial of Service

    WSS4J contains an integer overflow caused by improper DER bounds check allowing oversized allocation during X.509 certificate SubjectKeyIdentifier decoding, letting unauthenticated attackers exhaust server memory via crafted SOAP messages.

  • 7.5 /10 High
    CVE-2026-95587 No auth

    Hostinger Migrator - Broken Access Control

    Hostinger Migrator <= 1.0 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.8 /10 High
    CVE-2026-95531 Auth required

    Conversational Forms for ChatBot - PHP Object Injection

    Conversational Forms for ChatBot <= 1.5.0 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-94683 Auth required

    DesignSetGo - PHP Object Injection

    DesignSetGo <= 2.8.0 contains a PHP object injection caused by unsafe unserialization, letting attackers execute arbitrary code or manipulate application logic, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-94678 Auth required

    Go Live Update Urls - PHP Object Injection

    Go Live Update Urls <= 7.0.8 contains a PHP Object Injection caused by unsafe deserialization of user input, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-94677 Auth required

    Kadence WooCommerce Email Designer - PHP Object Injection

    Kadence WooCommerce Email Designer <= 1.5.19.1 contains a PHP Object Injection caused by unsafe deserialization, letting attackers inject malicious objects to execute arbitrary code, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-94499 Auth required

    FormGent - Broken Access Control

    FormGent <= 1.12.2 contains a broken access control vulnerability caused by improper authorization checks, letting attackers access or modify unauthorized resources, exploit requires no special privileges.

  • 9.0 /10 Critical
    CVE-2026-94389 No auth

    AcyMailing SMTP Newsletter - Remote Code Execution

    AcyMailing SMTP Newsletter <= 11.0.5 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code without authentication.

  • 7.5 /10 High
    CVE-2026-94178 Auth required

    Import and export users and customers - Privilege Escalation

    Import and export users and customers <= 2.5.2 contain a privilege escalation vulnerability caused by improper access control, letting attackers escalate their privileges, exploit requires user to be authenticated.

  • 8.5 /10 High
    CVE-2026-94177 Auth required

    GamiPress - SQL Injection

    GamiPress <= 8.0.2 contains an SQL injection caused by unsanitized input in database queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-94171 No auth

    CURCY - Reflected XSS

    CURCY <= 2.2.16 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-94123 No auth

    NextGEN Gallery - Arbitrary File Download

    NextGEN Gallery <= 4.5.0 contains an arbitrary file download vulnerability caused by insufficient access control, letting unauthenticated attackers download arbitrary files remotely, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-94122 Auth required

    Responsive Slider Gallery - PHP Object Injection

    Responsive Slider Gallery <= 1.5.5 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.