Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 400 of 695

  • 7.5 /10 High
    CVE-2026-95513 No auth

    Online Booking & Scheduling Calendar for WordPress by vcita - Broken Access Control

    Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted functionality, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-94487 No auth

    PublishPress Capabilities - Cross Site Request Forgery

    PublishPress Capabilities <= 2.50.1 contains an unauthenticated cross site request forgery caused by lack of proper request validation, letting remote attackers perform unauthorized actions, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-94367 Auth required

    OpenEye Apex Network Video Recorder - Command Injection

    OpenEye Apex Network Video Recorder (NVR) firmware >= 2.2.3.4 and < 3.5.4 contains a command injection caused by crafted backup-area configuration input in recbackup, letting authenticated administrators execute OS commands as nvr user.

  • 7.3 /10 High
    CVE-2026-94243 No auth

    Apache Sling Security Bundle - Broken Access Control

    Apache Sling Security Bundle < 1.3.2 contains a security filter weakness caused by ReferrerFilter accepting weaker-than-origin evidence, letting attackers bypass referrer checks, exploit requires crafted requests.

  • 7.4 /10 High
    CVE-2026-94183 No auth

    Arc Search - UI Spoofing

    Arc Search for Android < 1.12.10 contains a UI spoofing vulnerability caused by lack of fullscreen notification when a page enters fullscreen mode in background, letting remote attackers render fake UI elements to mislead users, exploit requires user to visit a crafted website.

  • 7.4 /10 High
    CVE-2026-94181 No auth

    Arc - UI Redress & Spoofing

    Arc browser contains an address bar spoofing vulnerability caused by a <select> element triggering requestFullscreen without showing fullscreen notification, letting attackers spoof the browser address bar, exploit requires no special conditions.

  • 7.1 /10 High
    CVE-2026-94179 No auth

    Razorpay Payment Button - Reflected XSS

    Razorpay Payment Button <= 2.4.9 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-94176 No auth

    Mang Board WP - Stored XSS

    Mang Board WP <= 2.4.1 contains an unauthenticated stored cross site scripting caused by improper input sanitization, letting remote attackers execute scripts without authentication.

  • 7.6 /10 High
    CVE-2026-94174 Auth required

    Email Log - SQL Injection

    Email Log <= 2.63 contains a SQL injection caused by unsanitized input in administrator functionality, letting attackers execute arbitrary SQL commands, exploit requires administrator privileges.

  • 8.5 /10 High
    CVE-2026-94124 Auth required

    WP EasyCart - SQL Injection

    WP EasyCart <= 5.9.4 contains a SQL injection caused by improper sanitization of user input, letting attackers execute arbitrary SQL queries, exploit requires contributor privileges.

  • 7.1 /10 High
    CVE-2026-93774 No auth

    WP Photo Album Plus - Reflected XSS

    WP Photo Album Plus <= 9.3.02.002 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 8.5 /10 High
    CVE-2026-93773 Auth required

    Mollie Forms - SQL Injection

    Mollie Forms <= 2.11.0 contains a SQL injection caused by unsanitized input in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-93622 CISA KEVNo auth

    WPS Limit Login - Stored XSS

    WPS Limit Login <= 1.5.9.3 contains an unauthenticated stored XSS caused by improper input sanitization, letting remote attackers execute scripts without authentication.

  • 8.5 /10 High
    CVE-2026-93527 Auth required

    Live Copy Paste for Elementor - SQL Injection

    Live Copy Paste for Elementor <= 1.5.10 contains a SQL injection caused by improper sanitization of user input, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-93526 No auth

    Event Tickets - Reflected XSS

    Event Tickets <= 5.29.4 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.