Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 577 of 677
- 7.5 /10 HighCVE-2026-90535 PoC public
Flowise - Denial of Service
Flowise < 3.1.4 contains an unauthenticated denial of service vulnerability caused by lack of ownership verification in /api/v1/text-to-speech/abort endpoint, letting attackers terminate active chatflow predictions, exploit requires known chatflow and chat identifiers.
- 8.2 /10 HighCVE-2026-89266 No auth
stb_vorbis - Buffer Overflow
stb_vorbis through 1.22 contains a buffer overflow caused by truncation of codebook multiplicands allocation size from size_t to int in start_decoder(), letting attackers trigger heap corruption or crashes via crafted Ogg Vorbis files, exploit requires crafted file.
- 8.0 /10 HighCVE-2026-87888 Auth required
YayPricing WordPress plugin - Stored XSS
YayPricing WordPress plugin < 3.5.7 contains a stored XSS caused by missing authorization check on a REST route saving pricing rules, letting users with subscriber role store JavaScript executing in admin's browser, exploit requires subscriber role or higher.
- 7.5 /10 HighCVE-2026-87842 No auth
Zonify WordPress - Authentication Bypass
Zonify WordPress plugin < 1.0.5 contains an authentication bypass caused by missing capability and authentication checks before returning stored account login token, letting unauthenticated attackers retrieve and use the token.
- 8.8 /10 HighCVE-2026-87759 Auth required
Add User Autocomplete WordPress plugin - Broken Access Control
Add User Autocomplete WordPress plugin < 1.2 contains a broken access control vulnerability caused by lack of capability and nonce checks in site-membership invitation creation, letting authenticated users escalate privileges to administrator on multisite installations, exploit requires authentication.
- 9.9 /10 CriticalCVE-2026-87719 Auth required
GitLab EE - Information Disclosure
GitLab EE 18.3 < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain an information disclosure caused by bypassing serialization in GraphQL subscription arguments, letting authenticated users with Duo Chat access obtain sensitive Advanced Search configurations.
- 10.0 /10 CriticalCVE-2026-85706 CISA KEVPoC publicNo auth
GitLab CE/EE - Path Traversal
GitLab CE/EE >= 18.7, < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain a path traversal caused by improper path confinement and missing authentication enforcement in the repository commits API, letting unauthenticated users read arbitrary files.
- 9.8 /10 CriticalCVE-2026-85681 No auth
WP Component WordPress - Broken Access Control
WP Component WordPress plugin through 2.2.4 contains a broken access control vulnerability caused by lack of capability and nonce checks on an action, letting unauthenticated attackers overwrite site options, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-85200 No auth
GEO my WP - Local File Inclusion
GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.
- 9.8 /10 CriticalCVE-2026-84171 No auth
Piclect WordPress plugin - Unrestricted File Upload
Piclect WordPress plugin <= 1.0 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file names and types, letting unauthenticated attackers upload arbitrary files and execute code on the server, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-84099 No auth
wpstorecart WordPress Plugin - Insecure Deserialization
wpstorecart WordPress plugin through 5.0.7 contains an insecure deserialization vulnerability caused by direct unauthenticated access to a bundled add-on that deserializes user input without class restrictions, letting unauthenticated attackers inject arbitrary PHP objects, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-84047 No auth
Album Cover Finder WordPress - SQL Injection
Album Cover Finder WordPress plugin <= 0.7.0 contains a sql injection caused by improper sanitization and escaping of a parameter in SQL query, letting unauthenticated attackers execute arbitrary SQL commands remotely.
- 9.9 /10 CriticalCVE-2026-82845 Auth required
Masteriyo LMS WordPress plugin - Insecure Deserialization
Masteriyo LMS WordPress plugin < 3.4.1 contains an insecure deserialization vulnerability caused by user-supplied metadata being deserialized, letting attackers with minimal accounts execute arbitrary code or write files, exploit requires user account.
- 8.8 /10 HighCVE-2026-81742 No auth
BE REST Endpoints WordPress - Stored XSS
BE REST Endpoints WordPress plugin through 1.0.0 contains a stored XSS caused by lack of authorization and input sanitization in widget operations, letting unauthenticated attackers execute arbitrary scripts in users' browsers.
- 7.1 /10 HighCVE-2026-81429 No auth
WPBakery Page Builder - Stored XSS
WPBakery Page Builder WordPress plugin <= 1.0.2 contains a stored cross-site scripting caused by lack of CSRF check and unsanitized template-import data, letting attackers execute script in administrator session via forged request.