Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 413 of 695

  • 8.1 /10 High
    CVE-2026-92969 No auth

    HUSKY Products Filter for WooCommerce Professional - Local File Inclusion

    HUSKY Products Filter for WooCommerce Professional <= 1.4.4 contains a local file inclusion caused by improper validation of the 'shortcode' parameter, letting unauthenticated attackers execute arbitrary PHP files, exploit requires nonce obtainable from front-end JavaScript.

  • 8.8 /10 High
    CVE-2026-92438 No auth

    Ninja Forms - Stored XSS

    Ninja Forms WordPress plugin 3.15.3 contains a stored XSS caused by unescaped submitted form field values on the submission edit screen, letting unauthenticated users execute scripts in high-privileged users' browsers, exploit requires form submission.

  • 7.5 /10 High
    CVE-2026-9231 Auth required

    WP Travel Engine – Tour Booking Plugin – Tour Operator Software - Local File Inclusion

    WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress <= 6.8.0 contains a local file inclusion caused by improper handling in wte_get_template function, letting authenticated contributors and above execute arbitrary PHP files, exploit requires contributor-level access or higher.

  • 8.1 /10 High
    CVE-2026-92235 Auth required

    WP Ultimate Review - Stored XSS

    WP Ultimate Review plugin for WordPress <= 2.4.2 contains a stored XSS caused by improper validation before running do_shortcode, letting authenticated attackers with subscriber-level access execute arbitrary shortcodes.

  • 7.5 /10 High
    CVE-2026-91827 No auth

    Ninja Forms - Insecure Deserialization

    Ninja Forms WordPress plugin 3.15.3 contains a PHP Object Injection caused by deserialization of user-submitted form field values during CSV export by administrators, letting unauthenticated attackers perform arbitrary file operations or remote code execution if a suitable POP chain exists.

  • 8.8 /10 High
    CVE-2026-91018 No auth

    lwIP - Use After Free

    lwIP contains a double free vulnerability caused by improper memory management, letting attackers cause denial of service, memory corruption, or remote code execution, exploit requires no special conditions.

  • 7.2 /10 High
    CVE-2026-89412 No auth

    TranslatePress - Stored Cross-Site Scripting

    TranslatePress WordPress plugin <= 3.3.5 contains a stored cross-site scripting caused by insufficient input sanitization in Translation Memory Suggestion Panel, letting unauthenticated attackers inject scripts executed in admin sessions, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-89407 No auth

    FasterXML jackson-core - Denial of Service

    FasterXML jackson-core >= 2.17.0 contains a denial of service vulnerability caused by inefficient regex backtracking in NumberInput.looksLikeValidNumber(), letting attackers supply crafted JSON to exhaust server resources, exploit requires deserialization of large numeric strings.

  • 9.1 /10 Critical
    CVE-2026-89282 No auth

    Apache HTTP Server - Broken Access Control

    Apache HTTP Server Windows distribution by Apache Lounge contains an insecure installation directory permissions vulnerability caused by default directory permissions on C:\, letting authenticated users write to the directory, exploit requires authenticated user access.

  • 8.4 /10 High
    CVE-2026-89281

    Apache Lounge Apache HTTP Server - Code Execution

    Apache Lounge Windows distribution of Apache HTTP Server contains a hardcoded configuration path vulnerability in openssl.cnf, letting local attackers execute code, exploit requires local access.

  • 9.9 /10 Critical
    CVE-2026-89276 Auth required

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-89275 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-88624 No auth

    openCode - Path Traversal

    openCode v1.18.26 contains a path traversal caused by missing path validation in the Worktree.remove component, letting attackers execute arbitrary recursive directory deletion, exploit requires crafted payload.

  • 8.8 /10 High
    CVE-2026-88419 Auth required

    WuzhiCMS - Remote Code Execution

    WuzhiCMS 5.0.0 contains an unrestricted file upload vulnerability caused by lack of extension allowlist and content validation in the thumbnail-upload endpoint, letting authenticated low-privileged members execute arbitrary PHP code on the server.

  • 8.8 /10 High
    CVE-2026-88418 No auth

    CMSimple - Stored XSS & Remote Code Execution

    CMSimple 5.24 contains a stored XSS and remote code execution caused by disabled CSRF protection and unsanitized scripting markers in admin content saving, letting unauthenticated attackers execute arbitrary PHP code via a logged-in admin's browser.