Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 619 of 677
- 7.5 /10 HighCVE-2026-19439 No auth
Ultimate Gift Cards for WooCommerce - Broken Access Control
Ultimate Gift Cards for WooCommerce WordPress plugin < 3.2.10 contains a broken access control vulnerability caused by lack of authorization checks when displaying gift card details, letting unauthenticated users disclose customer data and gift card information, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-19436 No auth
Ultimate Gift Cards for WooCommerce - Broken Access Control
Ultimate Gift Cards for WooCommerce WordPress plugin < 3.2.10 contains a broken access control vulnerability caused by lack of reconciliation between gift card coupon value and actual checkout amount, letting unauthenticated users obtain excess store credit, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-19136 No auth
Tianxi AI Agent PC Application - Command Injection
Tianxi AI Agent PC Application contains a command injection caused by handling of specially crafted links, letting local users execute arbitrary operating system commands, exploit requires local user interaction.
- 7.1 /10 HighCVE-2026-18994 Auth required
Lenovo File Manager - Broken Access Control
Lenovo File Manager Android Application contains an improper authorization vulnerability that allows a local authenticated user to read or modify protected files within the application, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-18351 PoC publicNo auth
Elementor Drag and Drop File Upload - Unrestricted File Upload
Elementor Drag and Drop File Upload plugin for WordPress <= 1.6.0 contains an arbitrary file upload vulnerability caused by insufficient file type validation in is_file_type_valid(), letting unauthenticated attackers upload executable files and achieve remote code execution.
- 7.5 /10 HighCVE-2026-15019 No auth
WooCommerce Direct Download - Path Traversal
WooCommerce Direct Download plugin <= 1.19 contains a directory traversal vulnerability caused by insufficient validation in the top-level include function, letting unauthenticated attackers read arbitrary files on the server, exploit requires presence of at least one free, virtual, downloadable product.
- 8.0 /10 HighCVE-2026-14873 Auth required
Bulk Password Reset WordPress plugin - Privilege Escalation
Bulk Password Reset WordPress plugin <= 1.3.3 contains a privilege escalation via account takeover caused by improper user identity validation before updating user details, letting authenticated attackers with subscriber-level access change arbitrary user emails and reset passwords.
- 7.8 /10 HighCVE-2026-11813 Auth required
Lenovo Filez Client - Privilege Escalation
Lenovo Filez Client contains an improper permissions vulnerability that allows local authenticated users to escalate privileges by exploiting incorrect permission settings.
- 7.2 /10 HighCVE-2026-0310
Palo Alto Networks PAN-OS - Buffer Overflow
Palo Alto Networks PAN-OS contains a buffer overflow caused by improper XML processing, letting unauthenticated attackers with network access cause denial of service or execute arbitrary code with root privileges, exploit requires network access to management or dataplane interface.
- 7.5 /10 HighCVE-2025-57231 PoC publicNo auth
Docmost - Path Traversal
Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL.
- 7.1 /10 HighCVE-2026-87999 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI < 0.11.1 contains a server-side request forgery caused by improper validation of destination addresses in API endpoints, letting authenticated users fetch internal Azure platform content, exploit requires user authentication.
- 7.1 /10 HighCVE-2026-87998 PoC publicAuth required
Open WebUI - Broken Access Control
Open WebUI 0.10.0 to 0.11.1 contains a broken access control vulnerability caused by missing administrator checks in DELETE /api/v1/knowledge/{id}/delete, letting non-administrator users with write access delete shared external connections, exploit requires write access to one external knowledge base.
- 7.7 /10 HighCVE-2026-87996 PoC publicAuth required
Open WebUI - Server Side Request Forgery
Open WebUI 0.9.6 to 0.11.1 contains an SSRF caused by inconsistent hostname validation in SafePlaywrightURLLoader, letting authenticated users with DNS control expose internal service responses, exploit requires authenticated user controlling DNS.
- 8.7 /10 HighCVE-2026-87995 PoC publicAuth required
Open WebUI - Stored XSS
Open WebUI 0.8.11 to 0.11.1 contains a stored XSS caused by rendering terminal port content in an iframe sandbox with allow-scripts and allow-same-origin, letting authenticated users with shared terminal access execute scripts and take over victim accounts, exploit requires victim to open the preview.
- 8.1 /10 HighCVE-2026-87930 PoC publicNo auth
MaxSite CMS - Insecure Deserialization
MaxSite CMS through 109.6 contains an insecure deserialization vulnerability caused by passing the ci_session cookie to unserialize() without class restrictions, letting unauthenticated attackers inject PHP objects and potentially execute code.