Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 635 of 677

  • 7.5 /10 High
    CVE-2026-15667 PoC publicAuth required

    Eventin WordPress Plugin - Local File Inclusion

    Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated contributors execute arbitrary PHP code, exploit requires contributor-level access.

  • 7.5 /10 High
    CVE-2026-15406 Auth required

    Eventin WordPress Plugin - Local File Inclusion

    Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated attackers with custom-level access include and execute arbitrary PHP files, exploit requires authenticated user with custom-level access or higher.

  • 7.2 /10 High
    CVE-2026-14989 No auth

    WPLP Cookie Consent - Stored XSS

    WPLP Cookie Consent plugin for WordPress <= 4.4.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'wpl_user_preference' parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-14962 PoC publicNo auth

    ELEX WooCommerce Request a Quote - SQL Injection

    ELEX WooCommerce Request a Quote WordPress plugin < 2.4.1 contains a SQL injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers extract arbitrary data from the database.

  • 8.8 /10 High
    CVE-2026-14359 CISA KEVAuth required

    YITH WooCommerce Waitlist Premium - Privilege Escalation

    YITH WooCommerce Waitlist Premium <= 3.35.0 contains a privilege escalation caused by missing capability check and nonce verification in add_user_in_waiting_list() function, letting authenticated attackers with Subscriber-level access create admin users.

  • 7.2 /10 High
    CVE-2026-13359 No auth

    BestWebSoft Contact Form to DB - Stored XSS

    BestWebSoft Contact Form to DB plugin for WordPress <= 1.7.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in cntctfrm_contact_dropdown parameter, letting unauthenticated attackers execute scripts in administrator sessions via message manager page, exploit requires unauthenticated contact form submission.

  • 8.2 /10 High
    CVE-2026-12855 Auth required

    HP Projects - Buffer Overflow

    HP projects contain a buffer overflow caused by unvalidated memory boundaries in custom code, letting attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2024-58382 No auth

    league/commonmark - Denial of Service

    league/commonmark < 2.6.0 contains a denial of service caused by polynomial time complexity in Markdown parsing, letting attackers exhaust CPU and PHP-FPM resources, exploit requires crafted Markdown inputs.

  • 7.5 /10 High
    CVE-2024-58381 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.11.1 contains a denial of service vulnerability caused by improper object initialization from scalar JSON types in LoginPacket JSON processing, letting remote attackers crash the server by sending malformed JSON data.

  • 7.5 /10 High
    CVE-2023-54393 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 4.20.5 contains a denial of service vulnerability caused by improper validation in JsonMapper during LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON structures, exploit requires network access.

  • 7.5 /10 High
    CVE-2023-54390 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service vulnerability caused by improper null value handling in LoginPacket JSON parsing, letting attackers crash the server by sending malformed JSON with unexpected null elements.

  • 7.5 /10 High
    CVE-2023-54355 No auth

    PocketMine-MP - Denial of Service

    PocketMine-MP < 5.3.1 and < 4.23.1 contain a denial of service caused by improper validation of identityPublicKey curve in LoginPacket, letting attackers crash the server by triggering exceptions during ECDH key derivation, exploit requires sending crafted LoginPackets.

  • 7.1 /10 High
    CVE-2026-86819 Auth required

    Waves Central - Privilege Escalation

    Waves Central for macOS contains a local privilege escalation caused by improper code-signing certificate validation in the privileged helper service, letting local authenticated users execute code with root privileges, exploit requires local authentication.

  • 7.3 /10 High
    CVE-2026-86810 No auth

    Open-Web-Analytics - Authentication Bypass

    Open-Web-Analytics <= 1.9.1 contains an authentication bypass caused by improper authentication in checkCapabilityAndAuthenticateUser function in Controller, letting remote attackers bypass authentication, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-86808 No auth

    moltis-org moltis - Authentication Bypass

    moltis-org moltis <= 20260818.10 contains a broken authentication caused by manipulation in vault_unlock_handler/vault_recovery_handler in vault.rs, letting remote attackers bypass authentication, exploit requires no special privileges.