Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 4 of 677

  • 7.5 /10 High
    CVE-2026-103525 No auth

    FluentCart WordPress - Broken Access Control

    FluentCart WordPress plugin <= 1.7.0 contains an insecure direct object reference caused by missing validation on user-controlled order_id and address_id parameters, letting unauthenticated attackers access other customers' billing and shipping PII by enumerating IDs.

  • 9.8 /10 Critical
    CVE-2026-103768 No auth

    ELEX WordPress HelpDesk & Customer Ticketing System - Unrestricted File Upload

    ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress <= 3.3.7 contains an unrestricted file upload vulnerability caused by insufficient file type validation in the initMailPart function, letting unauthenticated attackers upload executable files and achieve remote code execution.

  • 7.0 /10 High
    CVE-2026-105228 No auth

    Delta ISPSoft - Information Disclosure

    Delta ISPSoft contains an information disclosure vulnerability allowing remote attackers to access sensitive information, exploit requires no special privileges.

  • 7.0 /10 High
    CVE-2026-105227 No auth

    Delta ISPSoft - Information Disclosure

    Delta ISPSoft contains an information disclosure vulnerability allowing remote attackers to access sensitive information, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-110701 No auth

    CP Multi View Events Calendar - Stored XSS

    CP Multi View Events Calendar WordPress plugin <= 1.4.42 contains a stored cross-site scripting caused by insufficient sanitization and escaping of 'CalendarTitle' parameter, letting unauthenticated attackers inject scripts, exploit requires 'Allow edition in frontend?' enabled by admin.

  • 7.2 /10 High
    CVE-2026-97339 No auth

    Complianz GDPR/CCPA Cookie Consent Banner - Stored XSS

    Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress <= 7.5.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content via yotu-wp Cookie-Blocker Filter, letting unauthenticated attackers inject scripts executed by users visiting approved comments.

  • 7.2 /10 High
    CVE-2026-107758 No auth

    Colibri Page Builder - Stored XSS

    Colibri Page Builder WordPress plugin <= 1.0.390 contains a stored cross-site scripting caused by insufficient sanitization of 'comment' parameter allowing unauthenticated attackers to inject scripts executed on page load.

  • 7.8 /10 High
    CVE-2026-104715 PoC publicAuth required

    cifs-utils - Privilege Escalation

    cifs-utils contains a privilege escalation caused by improper sanitization of user-controlled credentials file during CIFS share mount, letting unprivileged local users execute files with root privileges, exploit requires local access.

  • 8.6 /10 High
    CVE-2026-14452 No auth

    Checkmk - Stored XSS & Open Redirect

    Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51, and 2.2.0 contain a stored XSS and open redirect caused by improper validation of the reset_url parameter in Setup in-page search, letting attackers execute scripts or redirect authenticated users with Setup access, exploit requires user interaction.

  • 7.3 /10 High
    CVE-2026-111210 No auth

    bitcoinj - Server Side Request Forgery

    bitcoinj <= 0.17 contains a server-side request forgery caused by manipulation of the "pki_type" argument in PaymentSession.java Payment Request Handler, letting remote attackers make arbitrary server requests, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-103896 No auth

    10Web Booster - Path Traversal

    10Web Booster WordPress plugin <= 2.34.5 contains a limited file write via path traversal caused by unsanitized $_GET parameters in cache path construction, letting unauthenticated attackers create arbitrary directories and poison cache, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-106708 No auth

    XXL-JOB - Cross-Site Request Forgery

    XXL-JOB <= 3.5.0-SNAPSHOT contains a cross-site request forgery caused by lack of CSRF protection and HTTP method restrictions in JobUserController endpoints /user/insert, /user/update, and /user/delete, letting attackers perform unauthorized actions, exploit requires victim user interaction.

  • 10.0 /10 Critical
    CVE-2026-110958 PoC publicNo auth

    Wavlink WN530HG4B - Buffer Overflow

    Wavlink WN530HG4B M30HG4B_V260724 contains a heap-based buffer overflow caused by improper handling in api.cgi, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-87018 No auth

    undici - Denial of Service

    undici HTTP client library for Node.js versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 contains a denial of service caused by unhandled TLS 1.2 renegotiation with mismatched hostname certificates, letting attackers crash the client process, exploit requires attacker-controlled HTTPS endpoint.

  • 7.5 /10 High
    CVE-2026-109869 No auth

    undici - Denial of Service

    undici 6.23.0 to 6.29.0, 7.18.0 to 7.30.0, and 8.0.0 to 8.12.1 contain a denial of service caused by improper handling of responses with more than five content codings and premature connection close in fetch(), letting remote unauthenticated servers crash the Node.js process, exploit requires malicious server response.