Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 438 of 695
- 7.2 /10 HighCVE-2026-15664 No auth
Quill Forms - Stored Cross-Site Scripting
Quill Forms WordPress plugin <= 5.7.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in Multiple Choice 'Other' value, letting unauthenticated attackers inject scripts executed in admin context, exploit requires no authentication.
- 7.2 /10 HighCVE-2026-13354 No auth
Asset CleanUp: Page Speed Booster - Stored XSS
Asset CleanUp: Page Speed Booster WordPress plugin <= 1.4.0.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts that execute on page access, exploit requires combine_loaded_css enabled.
- 7.5 /10 HighCVE-2026-1255 No auth
YS LeadGen WordPress Plugin - Sensitive Information Exposure
YS LeadGen WordPress plugin <= 2.1.4 contains a sensitive information exposure caused by unauthenticated access to 'ysleadgen_get_captured_data' AJAX action, letting unauthenticated attackers retrieve captured form submission data including PII.
- 7.5 /10 HighCVE-2026-93872 Auth required
Cotonti - Insecure Deserialization
Cotonti 1.0.0 contains an insecure deserialization vulnerability caused by passing base64-decoded cb parameter to unserialize() without allowed_classes restriction in comments plugin EditAction, letting registered users with comment write permissions instantiate arbitrary PHP objects and potentially achieve file write or code execution.
- 8.1 /10 HighCVE-2026-93868
Cotonti - Authentication Bypass
Cotonti through 1.0.0 contains a broken authentication caused by predictable password recovery tokens derived from md5(microtime()) in users.passrecover.php, letting unauthenticated attackers reset any account password including administrators, exploit requires attacker to read server Date header.
- 9.8 /10 CriticalCVE-2026-93839 No auth
LightLLM - Authentication Bypass
LightLLM through 1.2.0 contains an authentication bypass caused by lack of peer address validation in /pd_register WebSocket endpoint, letting unauthenticated attackers register arbitrary nodes and cause information disclosure and denial of service.
- 9.1 /10 CriticalCVE-2026-93765 No auth
Mongoid - Unsafe Reflection
Mongoid contains an unsafe reflection vulnerability in the document persistence layer caused by unsafe key handling from unauthenticated input, letting attackers cause unintended method invocation and data removal, exploit requires unauthenticated input.
- 9.8 /10 CriticalCVE-2026-93762 No auth
Mongoid - Unsafe Reflection
Mongoid contains an unsafe reflection weakness in the query path for embedded documents, letting unauthenticated attackers disclose stored data and delete records, exploit requires passing external field names to in-memory query methods.
- 7.5 /10 HighCVE-2026-93761 No auth
Mongoid - Denial of Service
Mongoid contains a denial of service caused by inefficient regular expression complexity in the in-memory query evaluation component, letting unauthenticated attackers cause excessive processing and application unresponsiveness, exploit requires user-supplied text in pattern-matching query.
- 8.2 /10 HighCVE-2026-93760 No auth
Mongoid - NoSQL Injection
Mongoid contains a NoSQL injection caused by unrestricted query operators from caller-supplied filter data, letting unauthenticated attackers influence database queries, exploit requires forwarding of external filter parameters.
- 8.6 /10 HighCVE-2026-93759 No auth
Mongoid - NoSQL Injection
Mongoid contains a nosql injection caused by unneutralized string-typed query criteria passed as server-side JavaScript expressions, letting unauthenticated attackers execute arbitrary code on the database, exploit requires attacker to control query arguments.
- 8.1 /10 HighCVE-2026-93758 Auth required
Mongoid - Broken Access Control
Mongoid contains a broken access control caused by insecure direct object reference in nested attributes handling, letting users with basic privileges access and modify records not owned by them, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-93753 No auth
deepmerge - Prototype Pollution
deepmerge <= 4.3.1 contains a prototype pollution vulnerability caused by improper validation of keys in mergeObject() function, letting attackers inject properties into object prototypes, exploit requires attacker-controlled source objects.
- 7.5 /10 HighCVE-2026-93752 No auth
CSSOM - Denial of Service
CSSOM through 0.5.0 contains a denial of service caused by failure to validate reserved property names in CSSStyleDeclaration.setProperty(), letting attackers trigger excessive memory allocation and process termination, exploit requires crafted stylesheet with reserved property.
- 7.5 /10 HighCVE-2026-93749 No auth
source-map-js - Denial of Service
source-map-js <= 1.2.1 contains a denial of service caused by improper validation of per-section offset line values in indexed source maps, letting attackers block the event loop synchronously, exploit requires crafted source maps.