Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 401 of 695
- 8.1 /10 HighCVE-2026-93508 Auth required
WC Fields Factory WordPress Plugin - Broken Access Control
WC Fields Factory WordPress plugin < 4.1.11 contains a broken access control vulnerability caused by improper restriction on field-management AJAX action, letting authenticated users with Subscriber-level access modify arbitrary post meta and pricing rules, exploit requires authenticated user with Subscriber-level or higher.
- 7.5 /10 HighCVE-2026-93368 No auth
Rename wp-login.php to anything you want WordPress plugin - SQL Injection
Rename wp-login.php to anything you want WordPress plugin <= 2.0.1 contains a time-based SQL injection caused by insufficient escaping of the 'log' username parameter, letting unauthenticated attackers extract sensitive database information.
- 9.8 /10 CriticalCVE-2026-93352 No auth
Laravel-Mediable - Remote Code Execution
Laravel-Mediable 7.0.0 before 7.0.2 contains a remote code execution vulnerability caused by incomplete extension blocklist missing .pht in config/mediable.php, letting attackers upload and execute PHP files remotely, exploit requires file upload capability.
- 8.8 /10 HighCVE-2026-93349 PoC publicNo auth
Frictionless - Command Injection
Frictionless <= 5.20.0rc1 contains a command injection caused by unsanitized shell metacharacters in resource path values within datapackage.json, letting attackers execute arbitrary OS commands as the user running the explore command, exploit requires attacker to supply a crafted Data Package descriptor.
- 7.8 /10 HighCVE-2026-91818
Foxit PDF Editor/Reader - Denial of Service
Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by reentrant page-event processing during annotation enumeration, letting attackers cause application crashes, exploit requires triggering specific page events.
- 7.8 /10 HighCVE-2026-91816 No auth
Foxit PDF Editor/Reader - Use After Free
Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by reentrant annotation deletion triggered by embedded JavaScript, letting attackers cause application crash, exploit requires embedded JavaScript execution.
- 7.8 /10 HighCVE-2026-91815 No auth
Foxit PDF Editor/Reader - Remote Code Execution
Foxit PDF Editor/Reader contains a buffer overflow caused by insufficient verification of JPEG2000 image metadata in PDF files, letting attackers cause crashes or execute arbitrary code remotely, exploit requires crafted PDF file.
- 8.8 /10 HighCVE-2026-91813 Auth required
Foxit PDF Editor/Reader - Privilege Escalation
Foxit PDF Editor/Reader contains a privilege escalation vulnerability caused by insufficient file locking and integrity validation in the update mechanism, letting local attackers execute arbitrary code with elevated privileges, exploit requires local access.
- 7.9 /10 HighCVE-2026-91812
Foxit PDF Editor/Reader - Man-in-the-Middle
Foxit PDF Editor/Reader contains a man-in-the-middle vulnerability caused by bypassing certificate validation and package integrity checks in the update mechanism, letting attackers execute arbitrary code with system privileges, exploit requires network interception.
- 7.8 /10 HighCVE-2026-91811 No auth
Foxit PDF Editor/Reader - Out of Bounds Write
Foxit PDF Editor/Reader contains a buffer overflow caused by insufficient validation of vertex indices in triangular fan texture meshes in the PRC parser, letting attackers cause memory corruption and application crash, exploit requires crafted malicious file.
- 7.8 /10 HighCVE-2026-91809 No auth
Foxit PDF Editor/Reader - Denial of Service
Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by improper validation during field-name traversal in malformed PDF form fields, letting attackers cause application crashes, exploit requires crafted PDF files.
- 7.8 /10 HighCVE-2026-91806 No auth
Foxit PDF Editor/Reader - Denial of Service
Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by embedded JavaScript accessing released PDF form-field references, letting attackers cause application crash, exploit requires crafted PDF with malicious JavaScript.
- 7.8 /10 HighCVE-2026-91805 No auth
Foxit PDF Editor/Reader - Use After Free
Foxit PDF Editor/Reader contains a use-after-free vulnerability caused by page-structure changes during rendering in PDF page-tree handling, letting attackers cause memory corruption and application crash, exploit requires crafted PDF.
- 7.8 /10 HighCVE-2026-91804 No auth
Foxit PDF Editor/Reader - Out of Bounds Write
Foxit PDF Editor/Reader contains a heap-based out-of-bounds write caused by insufficient validation of Circle annotation appearance geometry in rendering malformed Cloudy appearance streams, letting attackers cause memory corruption and crashes, exploit requires crafted PDF file.
- 8.8 /10 HighCVE-2026-91803 Auth required
Foxit PDF Editor/Reader - Privilege Escalation
Foxit PDF Editor/Reader contains a local privilege escalation caused by unsafe loading of dynamic-link libraries from user-writable directories during high-privilege operations, letting local attackers execute code with elevated privileges.