Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 435 of 695

  • 7.3 /10 High
    CVE-2026-93973 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "ID" argument in /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-93972 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "courseID" argument in /reviewer_0/admins/assessments/course/btn_functions.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-93970 No auth

    aiyiyi121 SxDevOps - Hardcoded Credentials

    aiyiyi121 SxDevOps 1.0/1.1 contains a hardcoded credentials vulnerability caused by insecure handling in backend/sxdevops/settings.py Settings Handler, letting remote attackers access credentials, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-93969 No auth

    aiyiyi121 SxDevOps - Hardcoded Credentials

    aiyiyi121 SxDevOps 1.0/1.1 contains a hardcoded credentials vulnerability caused by manipulation in ensure_default_superuser function in rbac/services.py, letting remote attackers use fixed credentials, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-93962 No auth

    Kamailio - Remote Code Execution

    Kamailio <= 5.8.8/6.0.7/6.1.4/6.2.0-dev1 contains a heap-based buffer overflow caused by manipulation in shm_malloc function of CDP Diameter Receiver, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-93959 No auth

    SourceCodester Online Reviewer Management System - SQL Injection

    SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "Course" argument in /reviewer_0/admins/assessments/course/btn_functions.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-93958 PoC publicAuth required

    D-Link R95 - Command Injection

    D-Link R95 BE9500_1.00.16 contains a command injection caused by manipulation of the NTPServer argument in /bin/ssi DHMAPI component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 7.2 /10 High
    CVE-2026-92541 Auth required

    Import and export users and customers WordPress plugin - Broken Access Control

    Import and export users and customers WordPress plugin < 2.5.2 contains a broken access control vulnerability caused by lack of enforcement of promote_users capability in front-end import, letting users with create_users capability promote users to administrator, exploit requires user with create_users capability.

  • 7.2 /10 High
    CVE-2026-92540 Auth required

    WordPress Import and export users and customers - Broken Access Control

    WordPress Import and export users and customers plugin < 2.5.2 contains a broken access control caused by improper enforcement of promote_users capability during CSV import, letting users with create_users capability escalate privileges to administrator, exploit requires user to have create_users capability.

  • 9.8 /10 Critical
    CVE-2026-90817 CISA KEVPoC publicNo auth

    REDCap - Remote Code Execution

    REDCap >= 13.3.0 contains a remote code execution caused by manipulation of HTTP requests and crafted file-path/stream parameters in survey passthrough routing and Data Import processing, letting unauthenticated attackers remotely execute code, exploit requires knowledge of a valid public survey hash.

  • 7.5 /10 High
    CVE-2026-87839 No auth

    Tripzzy WordPress - Broken Access Control

    Tripzzy WordPress plugin < 1.5.1 contains a broken access control vulnerability caused by missing authorization checks and lack of identifier validation in an AJAX action, letting unauthenticated attackers delete arbitrary comments.

  • 8.5 /10 High
    CVE-2026-87067 Auth required

    Forminator Forms - Remote Code Execution

    Forminator Forms WordPress plugin < 1.57.2.1 contains an insecure deserialization vulnerability caused by unrestricted class instantiation from XML-RPC requests, letting users with forms-management permission write files and execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-86553

    SmartLife - Authentication Bypass

    SmartLife app contains an authentication bypass caused by dynamic generation and misuse of authentication parameters in /account/verify.serv, letting attackers reset passwords by spoofing authentication and account ID, exploit requires attacker to acquire valid authentication parameters.

  • 7.5 /10 High
    CVE-2026-85017 Auth required

    Unlimited Elements For Elementor - Insecure Deserialization

    Unlimited Elements For Elementor WordPress plugin < 2.0.20 contains an insecure deserialization vulnerability caused by lack of capability check on an AJAX action, letting authenticated attackers with subscriber-level access inject arbitrary PHP objects.

  • 8.1 /10 High
    CVE-2026-82842

    SAML Single Sign On WordPress plugin - Authentication Bypass

    SAML Single Sign On WordPress plugin < 6.0.0 contains an authentication bypass caused by ignoring configured criteria for linking SSO identities, letting attackers authenticate as any account by asserting arbitrary login names, exploit requires control over identity provider assertions.