Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 578 of 677

  • 9.8 /10 Critical
    CVE-2026-81402 No auth

    DS Ad Rotator WordPress - Unrestricted File Upload

    DS Ad Rotator WordPress plugin through 0.8 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation in the image upload handler, letting unauthenticated attackers upload arbitrary files including PHP, leading to remote code execution.

  • 7.2 /10 High
    CVE-2026-81090 Auth required

    Gpx2Graphics WordPress Plugin - Cross Site Request Forgery & Remote Code Execution

    Gpx2Graphics WordPress plugin through 0.3 contains a cross site request forgery vulnerability caused by lack of CSRF check and file type validation in file upload handling, letting logged-in administrators upload arbitrary files leading to remote code execution.

  • 8.6 /10 High
    CVE-2026-80494 No auth

    Yogeta WP Cloud WordPress - Path Traversal

    Yogeta WP Cloud WordPress plugin through 1.0 contains a path traversal caused by lack of validation of user-supplied file path in a public endpoint, letting unauthenticated attackers download arbitrary files including sensitive credentials.

  • 8.6 /10 High
    CVE-2026-80491 No auth

    SAMO Forms WordPress - SQL Injection

    SAMO Forms WordPress plugin through 1.0.0 contains a SQL injection caused by improper sanitization and escaping of user input in several unauthenticated actions, letting unauthenticated attackers execute arbitrary SQL queries.

  • 8.8 /10 High
    CVE-2026-78175 CISA KEVAuth required

    Tutor LMS - Remote Code Execution

    Tutor LMS WordPress plugin <= 4.0.7 contains a PHP Object Injection caused by improper handling of the withdraw_method_field parameter in tutor_save_withdraw_account AJAX handler, letting authenticated attackers with subscriber access or higher achieve remote code execution, exploit requires monetization feature enabled and user registration allowed.

  • 9.8 /10 Critical
    CVE-2026-78159 CISA KEVPoC publicNo auth

    The Events Calendar WordPress plugin - Remote Code Execution

    The Events Calendar WordPress plugin <= 6.17.3 contains a remote code execution caused by insufficient validation of the widget 'classes' map in parse_array, letting unauthenticated attackers execute code remotely, exploit requires comments enabled on tribe_events posts with crafted wp:legacy-widget block comment.

  • 9.8 /10 Critical
    CVE-2026-78006 CISA KEVPoC publicNo auth

    The Events Calendar WordPress Plugin - Remote Code Execution

    The Events Calendar WordPress plugin <= 6.17.4 contains a remote code execution vulnerability caused by insufficient protection in is_safe_widget_instance and forged wp_hash integrity attribute, letting unauthenticated attackers execute code remotely, exploit requires comments enabled and visible on events.

  • 7.2 /10 High
    CVE-2026-77752 Auth required

    Temporary Login Without Password WordPress - Broken Access Control

    Temporary Login Without Password WordPress plugin < 1.9.9 contains a broken access control caused by missing verification of network super admin rights, letting site administrators escalate privileges to network super admin, exploit requires attacker to be a site administrator.

  • 7.2 /10 High
    CVE-2026-77705 Auth required

    Booking for Appointments and Events Calendar WordPress plugin - Broken Access Control

    Booking for Appointments and Events Calendar WordPress plugin < 2.4.10 contains a broken access control vulnerability caused by lack of verification on user entitlement when editing linked WordPress accounts, letting users with customer or employee management permissions modify other users' passwords and emails to take over accounts, exploit requires user to have customer or employee management permissions.

  • 9.6 /10 Critical
    CVE-2026-77006 Auth required

    WebTotem Backups WordPress Plugin - Unrestricted File Deletion

    WebTotem Backups WordPress plugin through 1.0.1 contains an unrestricted file deletion vulnerability caused by lack of file path validation, capability checks, and CSRF enforcement, letting authenticated users delete arbitrary files, exploit requires user authentication.

  • 9.6 /10 Critical
    CVE-2026-77005 Auth required

    CODE MONKEYS PROPOSALS WordPress - Broken Access Control

    CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 contains a broken access control caused by lack of user capability checks and file path validation before file deletion, letting authenticated users delete arbitrary files, exploit requires user authentication.

  • 9.8 /10 Critical
    CVE-2026-75800 No auth

    Frontegg SAML SSO WordPress plugin - Authentication Bypass

    Frontegg SAML SSO WordPress plugin <= 1.0.1 contains a broken authentication caused by lack of signature and issuer verification in SAML responses, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-16482 No auth

    rtMedia for WordPress - SQL Injection

    rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 contains a time-based blind SQL Injection caused by insufficient escaping of the 'compare' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires a public page with rtMedia shortcode and crafted rtmedia_shortcode GET parameter.

  • 8.8 /10 High
    CVE-2026-15451 Auth required

    MemberPress Corporate Accounts - Privilege Escalation

    MemberPress Corporate Accounts WordPress plugin <= 1.5.39 contains a privilege escalation caused by mass assignment in 'add_sub_account_user' passing unfiltered 'userdata' to 'wp_insert_user', letting authenticated corporate account users escalate privileges, exploit requires subscriber-level access or higher.

  • 7.6 /10 High
    CVE-2026-90460 Auth required

    OpenStack Keystone - Broken Access Control

    OpenStack Keystone < 29.0.3 contains a broken access control vulnerability caused by delegated authentication tokens not being properly restricted in /v3/credentials API, letting attackers create, modify, delete credentials and read sensitive secrets, exploit requires use of delegated authentication tokens.