Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 725 of 767
- 7.8 /10 HighCVE-2026-21088 Auth required
libsubextractor.so - Buffer Overflow
libsubextractor.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by improper input validation in loading a subtitle frame, letting local attackers write out-of-bounds memory, exploit requires local access.
- 7.8 /10 HighCVE-2026-21087 Auth required
libmdnie.so - Buffer Overflow
libmdnie.so prior to SMR Sep-2026 Release 1 contains a buffer overflow caused by out-of-bounds write, letting local attackers execute arbitrary code with system server privileges, exploit requires local access.
- 7.8 /10 HighCVE-2026-21086 Auth required
ProxyHandler - Broken Access Control
ProxyHandler prior to SMR Aug-2026 Release 1 contains an improper authorization vulnerability caused by insufficient access control, letting local attackers access proxy configuration, exploit requires local access.
- 7.5 /10 HighCVE-2026-19201 No auth
Google go-attestation - Denial of Service
Google go-attestation <= 0.6.1 contains a denial of service caused by uncontrolled recursion in the Windows SIPA event log parser's readELAMAggregation function, letting attackers crash the verifier via crafted nested elamAggregation events, exploit requires crafted Windows event log input.
- 8.1 /10 HighCVE-2026-18147 No auth
FreeIPA - Stored XSS
FreeIPA contains a stored XSS caused by DOM manipulation in the Web UI password reset page, letting unauthenticated remote attackers execute arbitrary JavaScript via crafted links, exploit requires victim interaction.
- 7.2 /10 HighCVE-2026-17553 Auth required
WP EasyCart - Privilege Escalation
WP EasyCart <= 5.9.3 contains a privilege escalation caused by insecure update_option() calls in ec_ajax_save_page_default_options() AJAX handler, letting authenticated Store Manager-level users escalate to administrator by modifying WordPress options, exploit requires authenticated user with Store Manager or higher privileges.
- 7.5 /10 HighCVE-2026-16960 No auth
Loops & Logic WordPress - Information Disclosure
Loops & Logic WordPress plugin < 4.3.0 contains an information disclosure vulnerability caused by insufficient restriction on public template-data action, letting unauthenticated users read arbitrary user records and site options, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-16272 No auth
PayTR Virtual Pos iFrame API WHMCS Module - Authentication Bypass
PayTR Virtual Pos iFrame API (v9x) WHMCS Module >= 9.0.0 < 9.0.3 contains a use of less trusted source vulnerability caused by improper validation of trusted identifiers, letting attackers exploit trusted identifiers, exploit requires crafted requests.
- 7.7 /10 HighCVE-2026-15913 Auth required
Fortra GoAnywhere MFT - Path Traversal
Fortra GoAnywhere MFT < 7.10.2 contains a path traversal caused by improper validation in /attachRemoteFiles endpoint, letting web users with Secure Folders and Secure Mail permissions read arbitrary files outside their sandbox, exploit requires specific permissions.
- 7.5 /10 HighCVE-2026-15667 PoC publicAuth required
Eventin WordPress Plugin - Local File Inclusion
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated contributors execute arbitrary PHP code, exploit requires contributor-level access.
- 7.5 /10 HighCVE-2026-15406 Auth required
Eventin WordPress Plugin - Local File Inclusion
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated attackers with custom-level access include and execute arbitrary PHP files, exploit requires authenticated user with custom-level access or higher.
- 7.2 /10 HighCVE-2026-14989 No auth
WPLP Cookie Consent - Stored XSS
WPLP Cookie Consent plugin for WordPress <= 4.4.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'wpl_user_preference' parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires no authentication.
- 8.6 /10 HighCVE-2026-14962 PoC publicNo auth
ELEX WooCommerce Request a Quote - SQL Injection
ELEX WooCommerce Request a Quote WordPress plugin < 2.4.1 contains a SQL injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers extract arbitrary data from the database.
- 8.8 /10 HighCVE-2026-14359 CISA KEVAuth required
YITH WooCommerce Waitlist Premium - Privilege Escalation
YITH WooCommerce Waitlist Premium <= 3.35.0 contains a privilege escalation caused by missing capability check and nonce verification in add_user_in_waiting_list() function, letting authenticated attackers with Subscriber-level access create admin users.
- 7.2 /10 HighCVE-2026-13359 No auth
BestWebSoft Contact Form to DB - Stored XSS
BestWebSoft Contact Form to DB plugin for WordPress <= 1.7.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in cntctfrm_contact_dropdown parameter, letting unauthenticated attackers execute scripts in administrator sessions via message manager page, exploit requires unauthenticated contact form submission.