Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 452 of 695
- 7.7 /10 HighCVE-2026-18912 Auth required
ManageEngine DataSecurity Plus - SQL Injection
ManageEngine DataSecurity Plus < 6310 contains an authenticated SQL injection caused by improper input sanitization in the Reports module, letting authenticated technicians execute arbitrary SQL queries.
- 7.5 /10 HighCVE-2026-18911
ManageEngine DataSecurity Plus - Authentication Bypass
ManageEngine DataSecurity Plus < 6310 contains an agent authentication bypass caused by improper validation of agent enrollment, letting unenrolled agents send requests without authentication, exploit requires unenrolled agent access.
- 7.5 /10 HighCVE-2026-18442 No auth
WCFM Marketplace – Multivendor Marketplace for WooCommerce - SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce WordPress plugin <= 3.8.2 contains a SQL injection caused by insufficient escaping of 'wcfmmp_user_location_lng' parameter, letting unauthenticated attackers extract sensitive database information, exploit requires crafted parameter input.
- 7.2 /10 HighCVE-2026-18405 No auth
Jeg Kit for Elementor - Stored Cross-Site Scripting
Jeg Kit for Elementor WordPress plugin <= 3.2.16 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in comment content, letting unauthenticated attackers inject scripts executed when users access affected pages, exploit requires targeted post rendering Jeg Kit Countdown widget.
- 8.6 /10 HighCVE-2026-17619 No auth
IBM Platform RTM - SQL Injection
IBM Platform RTM contains a sql injection caused by improper sanitization of SQL statements, letting remote attackers view, add, modify, or delete information in the back-end database, exploit requires crafted SQL statements.
- 8.8 /10 HighCVE-2026-17086 Auth required
ShortPixel Image Optimizer - Insecure Deserialization
ShortPixel Image Optimizer WordPress plugin <= 6.5.5 contains a PHP Object Injection caused by deserialization of untrusted input, letting authenticated attackers with author-level access inject PHP objects, exploit requires presence of a POP chain in other installed plugins or themes.
- 7.5 /10 HighCVE-2026-15275 No auth
WP Multi Store Locator Pro - SQL Injection
WP Multi Store Locator Pro for WordPress <= 4.5.1 contains a SQL injection caused by insufficient escaping of 'store_locatore_search_radius' parameter in an unquoted numeric SQL context, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-14323 No auth
Printcart Web to Print Product Designer for WooCommerce - Path Traversal
Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 contains a directory traversal caused by improper validation of the 'mockups' parameter, letting unauthenticated attackers read arbitrary files, exploit requires nonce bypass or disabled nonce check.
- 9.8 /10 CriticalCVE-2026-13684 No auth
Synology DiskStation Manager - Improper Output Encoding
Synology DiskStation Manager (DSM) < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an improper encoding or escaping of output vulnerability in SCGI, letting remote attackers read or write arbitrary files and cause denial-of-service, exploit requires network access.
- 8.8 /10 HighCVE-2026-13673 Auth required
Synology DiskStation Manager - Broken Access Control
Synology DiskStation Manager < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an incorrect permission assignment vulnerability in LDAP API, letting remote authenticated users read/write arbitrary files and cause denial of service.
- 9.8 /10 CriticalCVE-2026-13639 No auth
Synology DiskStation Manager - Insufficient Entropy Vulnerability
Synology DiskStation Manager (DSM) < 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 contains an insufficient entropy vulnerability in login logic, letting remote attackers read or write arbitrary files and cause denial of service, exploit requires network access.
- 8.8 /10 HighCVE-2026-12954 Auth required
Mapster WP Maps - Broken Access Control
Mapster WP Maps WordPress plugin <= 1.23.0 contains an arbitrary user meta write vulnerability caused by lack of nonce verification, capability check, and allowlist validation in my_profile_update(), letting authenticated attackers with Subscriber-level access update arbitrary user meta values.
- 8.8 /10 HighCVE-2026-12384 Auth required
TECHIN2B TECHIN2B Application - Authorization Bypass
TECHIN2B TECHIN2B Application from V1.0.7676.13 through 18092026 contains an authorization bypass caused by user-controlled key manipulation, letting attackers abuse privileges, exploit requires no special conditions.
- 8.1 /10 HighCVE-2026-11727 No auth
IBM MQ for HPE NonStop - Remote Code Execution & Denial of Service
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains a remote code execution and denial of service vulnerability caused by improper validation of queue manager responses when requesting AMS policy data, letting remote attackers cause denial of service or execute arbitrary code.
- 8.1 /10 HighCVE-2026-11726 Auth required
IBM MQ for HPE NonStop - Information Disclosure & Denial of Service
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 contains an information disclosure and denial of service vulnerability caused by improper validation of message header offset values, letting authenticated attackers obtain sensitive information or cause service disruption.