Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 45 of 891

  • 8.8 /10 High
    CVE-2026-118082 Auth required

    Buddyboss Platform - Privilege Escalation

    Buddyboss Platform <= 3.5.0 contains a privilege escalation vulnerability caused by improper access control, letting subscribers escalate their privileges, exploit requires subscriber account.

  • 8.8 /10 High
    CVE-2026-118081 Auth required

    10Web Social Photo Feed - PHP Object Injection

    10Web Social Photo Feed <= 1.5.6 contains a PHP Object Injection caused by unsafe unserialize usage, letting attackers inject arbitrary objects to manipulate application behavior, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118080 Auth required

    Social Snap - PHP Object Injection

    Social Snap <= 1.5.4 contains a PHP Object Injection caused by unsafe deserialization, letting attackers inject malicious objects to execute arbitrary code, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-118079 Auth required

    FV Flowplayer Video Player - PHP Object Injection

    Shop manager FV Flowplayer Video Player <= 8.3.4 contains a PHP Object Injection caused by unsafe unserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-118078 Auth required

    Shop Manager - PHP Object Injection

    Shop Manager PHP Object Injection in Product Catalog Feed <= 3.1.4 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-118077 Auth required

    Sastra Essential Addons for Elementor - PHP Object Injection

    Sastra Essential Addons for Elementor <= 1.2.3 contains a PHP object injection caused by unsafe deserialization, letting attackers execute arbitrary code, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118076 Auth required

    Frisbii Pay - PHP Object Injection

    Frisbii Pay <= 1.8.19 contains a PHP Object Injection caused by unsafe unserialization, letting attackers inject arbitrary objects to manipulate application behavior, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118075 Auth required

    WP Media folders - PHP Object Injection

    WP Media folders <= 1.1.10 contain a PHP object injection caused by unsafe deserialization, letting contributor attackers execute arbitrary code, exploit requires contributor privileges.

  • 7.2 /10 High
    CVE-2026-118074 Auth required

    Shop Manager Finale Lite - PHP Object Injection

    Shop Manager Finale Lite <= 2.21.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-118073 Auth required

    News Kit Elementor Addons - PHP Object Injection

    News Kit Elementor Addons <= 1.5.0 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-117611 No auth

    Checkmk - Improper Certificate Validation

    Checkmk < 2.5.0p18, < 2.4.0p39, < 2.3.0p52, and 2.2.0 contain an improper certificate validation caused by inclusion of a root CA trusting eMudhra intermediate certificates with public private keys, letting attackers bypass TLS validation, exploit requires use of affected certificate bundles.

  • 7.2 /10 High
    CVE-2026-116869 Auth required

    Shop manager myPOS Checkout - PHP Object Injection

    Shop manager myPOS Checkout <= 1.4.5 contains a PHP Object Injection caused by unsafe deserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-116868 Auth required

    BuddyPress Xprofile Custom Field Types - PHP Object Injection

    BuddyPress Xprofile Custom Field Types <= 1.3.1 contains a PHP object injection caused by improper handling of user input, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-116867 Auth required

    Dynamic QR Code generator - PHP Object Injection

    Contributor PHP Object Injection in Dynamic QR Code generator <= 1.0.1 contains a PHP object injection vulnerability caused by unsafe deserialization, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-116866 Auth required

    Extra Fees Plugin for WooCommerce - PHP Object Injection

    Extra Fees Plugin for WooCommerce <= 4.4.0 contains a PHP Object Injection caused by unsafe unserialization, letting attackers execute arbitrary code or commands remotely, exploit requires crafted input.