Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 575 of 677
- 7.3 /10 HighCVE-2026-90522 No auth
jaychouchannel Tourism-Management-System - Authentication Bypass
jaychouchannel Tourism-Management-System contains a broken authentication caused by weak password recovery in resetPass function of UsersController.java, letting remote attackers bypass password recovery, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90516 No auth
SourceCodester School Registration and Fee System - SQL Injection
SourceCodester School Registration and Fee System 1.0 contains a SQL injection caused by manipulation of the "period" argument in /bilal/normal/pay_report.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90515 No auth
SourceCodester School Registration and Fee System - SQL Injection
SourceCodester School Registration and Fee System 1.0 contains a SQL injection caused by manipulation of the argument selector[] in /bilal/normal/delete_stud.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90514 No auth
SourceCodester School Registration and Fee System - SQL Injection
SourceCodester School Registration and Fee System 1.0 contains a sql injection caused by manipulation of the "Status" argument in /bilal/normal/save_stud.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 8.3 /10 HighCVE-2026-90510 No auth
Dromara Orion-Visor - Weak Cryptography
Dromara Orion-Visor <= 2.5.7 contains a weak cryptography vulnerability caused by use of hard-coded cryptographic key in HostKeyServiceImpl.encryptKey, letting remote attackers compromise cryptographic security, exploit requires network access.
- 7.3 /10 HighCVE-2026-90509 No auth
dromara orion-visor - Hardcoded Credentials
dromara orion-visor <= 2.5.7 contains a hardcoded credentials vulnerability caused by manipulation in ExposeApiAspect.beforeExposeApi, letting remote attackers access hardcoded credentials, exploit requires remote access.
- 7.3 /10 HighCVE-2026-90504 No auth
vvbbnn00 WARP-Clash-API - Authentication Bypass
vvbbnn00 WARP-Clash-API contains an authentication bypass caused by manipulation of the SECRET_KEY argument in the authorized function, letting remote attackers bypass authentication, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-90498 No auth
Lenve vhr - Authentication Bypass
Lenve vhr 1.0-SNAPSHOT contains a broken authentication caused by use of default credentials in vhr.sql, letting remote attackers gain unauthorized access, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-90495 No auth
Fengoffice Feng Office - SQL Injection
Fengoffice Feng Office <= 3.11.13.11 contains a SQL injection caused by manipulation of the "auth" argument in Contacts::instance->findAll function of Legacy API, letting remote attackers execute arbitrary SQL queries, exploit requires no special privileges.
- 8.8 /10 HighCVE-2026-90493 Auth required
Tonec Internet Download Manager - Broken Access Control
Tonec Internet Download Manager <= 6.42 Build 63 on Windows contains an improper access control vulnerability caused by an issue in the Kernel Driver component idmwfp.sys, letting local attackers gain unauthorized access, exploit requires local access.
- 7.5 /10 HighCVE-2026-89080 Auth required
Really Simple Security WordPress plugin - Authentication Bypass
Really Simple Security WordPress plugin < 9.8.1 contains a broken authentication caused by unauthenticated reset of completed email two-factor enrolment, letting attackers with account password bypass second factor and obtain user session, exploit requires attacker to know account password.
- 7.5 /10 HighCVE-2026-88802 No auth
MDJM Event Management & Mobile Events Manager WordPress Plugins - Broken Access Control
MDJM Event Management WordPress plugin < 1.7.8.5 and Mobile Events Manager WordPress plugin <= 1.4.8.3 contain a broken access control vulnerability caused by missing capability, nonce, and record type checks in playlist entry removal, letting unauthenticated attackers permanently delete arbitrary posts, pages, and media attachments, exploit requires crafted request.
- 8.8 /10 HighCVE-2026-88793 No auth
YouTube Embed WordPress - Stored XSS
YouTube Embed WordPress plugin 10.0 to 10.3 contains a stored XSS caused by lack of authorization check and unescaped stored data in an AJAX action, letting unauthenticated attackers execute scripts in user sessions, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-86406 Auth required
User Registration & Membership WordPress plugin - Broken Access Control
User Registration & Membership WordPress plugin < 5.2.8 contains a broken access control vulnerability caused by lack of capability checks and validation on membership purchase, letting authenticated users escalate privileges to roles including administrator, exploit requires user authentication.
- 8.8 /10 HighCVE-2026-85129 No auth
Hoo Companion WordPress - Stored XSS & Data Tampering
Hoo Companion WordPress plugin 1.0.2 contains a stored XSS caused by lack of authorization and data sanitization in an import feature, letting unauthenticated attackers inject scripts and destroy theme settings, exploit requires no authentication.