Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 47 of 891

  • 7.1 /10 High
    CVE-2026-115611 No auth

    PluginUs.Net TableOn - Reflected XSS

    PluginUs.Net TableOn <= 1.0.7 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted request.

  • 7.5 /10 High
    CVE-2026-115599 No auth

    ThimPress LearnPress - Broken Access Control

    ThimPress LearnPress <= 4.4.11 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-115592 No auth

    OceanWP OceanWP - Reflected XSS

    OceanWP OceanWP <= 4.2.7 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.

  • 9.3 /10 Critical
    CVE-2026-114358 No auth

    Radius Xenia M2M Platform - SQL Injection

    Radius Xenia M2M Platform contains a SQL injection caused by insufficient validation of user input in the password recovery functionality, letting unauthenticated remote attackers access or modify database records.

  • 7.5 /10 High
    CVE-2026-114193 No auth

    Eyal Fitoussi GEO my WordPress - Broken Access Control

    Eyal Fitoussi GEO my WordPress <= 4.5.5.5 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.

  • 7.8 /10 High
    CVE-2026-114148 PoC publicAuth required

    ASP.NET Core - Privilege Escalation

    ASP.NET Core contains a privilege escalation caused by incorrect default permissions, letting authorized attackers elevate privileges locally, exploit requires attacker to be authorized.

  • 8.6 /10 High
    CVE-2026-113387 No auth

    Ortto WordPress Plugin - Stored XSS

    Ortto plugin for WordPress < 1.0.25 contains a stored XSS caused by unauthenticated configuration update requests relying on a publicly exposed secret, letting unauthenticated attackers serve arbitrary scripts.

  • 7.1 /10 High
    CVE-2026-112827 Auth required

    VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce - Broken Access Control

    VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce <= 1.0.10 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.

  • 9.2 /10 Critical
    CVE-2026-112256 No auth

    OpenText Advanced Authentication Server - Broken Access Control

    OpenText Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 contains an access control vulnerability caused by acceptance of extraneous untrusted data with trusted data, letting attackers access functionality not properly constrained by ACLs, exploit requires no special conditions.

  • 8.7 /10 High
    CVE-2026-112200 No auth

    P-Net - Denial of Service

    P-Net before 1.0.3 contains a denial of service caused by failure to release Application Relationship and RPC session on rejected RPC requests with incorrect endianness, letting remote unauthenticated attackers exhaust sessions.

  • 8.7 /10 High
    CVE-2026-111736 No auth

    P-Net - Denial of Service

    P-Net < 1.0.3 contains a denial of service caused by NULL pointer dereference in pf_fspm_cm_read_ind() when handling implicit read requests without valid target AR UUID, letting remote unauthenticated attackers crash the device.

  • 7.1 /10 High
    CVE-2026-111735 No auth

    P-Net - Integer Underflow

    P-Net before 1.0.3 contains an integer underflow caused by improper offset calculation in pf_cpm_c_data_ind() when handling short cyclic data frames, letting attackers cause denial of service or memory disclosure, exploit requires crafted short frame.

  • 7.1 /10 High
    CVE-2026-111734 No auth

    P-Net - Out of Bounds Read

    P-Net before 1.0.3 contains a buffer over-read caused by lack of Ethernet frame length validation in pf_eth_recv(), letting attackers cause denial of service or memory disclosure, exploit requires crafted Ethernet frames.

  • 8.7 /10 High
    CVE-2026-111733 No auth

    P-Net - Denial of Service

    P-Net before 1.0.3 contains a null pointer dereference caused by handling implicit read requests without valid target AR UUID for specific record indices, letting remote unauthenticated attackers cause denial of service.

  • 9.3 /10 Critical
    CVE-2026-111732

    P-Net - Buffer Overflow

    P-Net before 1.0.3 contains a buffer overflow caused by improper length parsing in ARVendorBlock request when PNET_OPTION_AR_VENDOR_BLOCKS is enabled, letting attackers cause denial of service or remote code execution, exploit requires this option enabled.