Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 436 of 695
- 7.2 /10 HighCVE-2026-81650 Auth required
Photo Gallery, Sliders, Proofing WordPress plugin - Unrestricted File Upload
Photo Gallery, Sliders, Proofing WordPress plugin < 4.5.0 contains a file upload vulnerability caused by improper validation of file extensions in extracted archives, letting users with gallery-management capability write arbitrary files and execute code, exploit requires gallery-management capability.
- 7.5 /10 HighCVE-2026-94056
Exim - Information Disclosure
Exim < 4.100.1 contains an information disclosure vulnerability caused by uninitialized stack memory read when Proxy-Protocol is used with an attacker-controlled proxy, letting attackers read sensitive data, exploit requires attacker-controlled proxy.
- 7.0 /10 HighCVE-2026-94054
Exim - Buffer Overflow
Exim < 4.100.1 contains a buffer overflow caused by out-of-bounds write when Proxy-Protocol is used with an attacker-controlled proxy, letting remote attackers cause memory corruption, exploit requires attacker-controlled proxy.
- 8.8 /10 HighCVE-2026-93993 No auth
Mistral Vibe - Remote Code Execution
Mistral Vibe < 2.25.5 contains a remote code execution caused by execution of git hooks before trust validation in the worktree creation process, letting attackers execute arbitrary shell commands with user privileges, exploit requires crafted repository with malicious post-checkout hook.
- 8.1 /10 HighCVE-2026-93992 No auth
Gopeed - Path Traversal
Gopeed <= 2.0.0-beta.3 contains a path traversal vulnerability caused by improper validation in archive extraction, letting attackers write arbitrary files outside the extraction directory, exploit requires users to download and extract malicious archives with AutoExtract enabled.
- 7.7 /10 HighCVE-2026-93991 Auth required
Argo Workflows - Authorization Bypass
Argo Workflows 4.1.0 through 4.1.3 contain an authorization bypass caused by improper cluster-scoped access review in ListArchivedWorkflows with NotEquals namespace field selector, letting attackers with namespace-scoped list permissions access archived workflows across namespaces.
- 7.5 /10 HighCVE-2026-93990 No auth
Expat - XML Injection
Expat through 2.8.4 contains an XML injection vulnerability caused by failure to validate low surrogates following high surrogates in UTF-16 input, letting attackers craft malformed UTF-16 sequences to hide markup characters, exploit requires crafted UTF-16 encoded XML.
- 9.9 /10 CriticalCVE-2026-93985 Auth required
OpenPanel js-runtime - Remote Code Execution
OpenPanel js-runtime contains a sandbox escape vulnerability caused by failure to block computed member access to constructor chains in the JavaScript webhook template validator, letting attackers with project write access execute arbitrary code in the worker process.
- 8.8 /10 HighCVE-2026-93923 No auth
SiYuan - Stored XSS
SiYuan through 3.8.4 contains a stored XSS caused by failure to escape heading style attributes in outline and bookmark dock HTML rendering, letting attackers execute scripts with full system access, exploit requires crafted notebooks or admin endpoint access.
- 8.8 /10 HighCVE-2026-93922 No auth
SiYuan - Stored XSS & Remote Code Execution
SiYuan <= 3.8.4 contains a stored cross-site scripting caused by rendering notebook names as raw HTML in the Daily Note picker dialog, letting attackers execute JavaScript with Node.js access and OS commands, exploit requires attacker to create notebooks with malicious names.
- 9.9 /10 CriticalCVE-2026-93742 Auth required
Totolink A3002MU - Command Injection
Totolink A3002MU Hh-B20211125.1046 contains a command injection caused by manipulation of the "localPin" argument in /boafrm/formWsc, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-93741 No auth
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlWds, letting remote attackers cause memory corruption or execute code, exploit requires crafted request.
- 8.8 /10 HighCVE-2026-92807 Auth required
PDFCrowd Save as PDF Plugin - Arbitrary Function Invocation
PDFCrowd Save as PDF Plugin for WordPress <= 4.6.1 contains an arbitrary function invocation vulnerability caused by unsanitized pdf_created_callback shortcode attribute, letting authenticated contributors invoke arbitrary PHP functions, exploit requires Contributor-level access.
- 7.5 /10 HighCVE-2026-92404 No auth
MgoSync WordPress Plugin - Broken Access Control
MgoSync WordPress plugin < 2.1.7 contains a broken access control vulnerability caused by missing authorization on a REST API endpoint, letting unauthenticated users retrieve stored WooCommerce API credentials.
- 9.1 /10 CriticalCVE-2026-92229 CISA KEVPoC publicNo auth
Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Stored XSS
Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin <= 1.57.2 contains a stored XSS caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes.