Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 792 of 891

  • 7.5 /10 High
    CVE-2026-85200 No auth

    GEO my WP - Local File Inclusion

    GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.

  • 9.8 /10 Critical
    CVE-2026-84171 No auth

    Piclect WordPress plugin - Unrestricted File Upload

    Piclect WordPress plugin <= 1.0 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file names and types, letting unauthenticated attackers upload arbitrary files and execute code on the server, exploit requires no authentication.

  • 8.1 /10 High
    CVE-2026-84099 No auth

    wpstorecart WordPress Plugin - Insecure Deserialization

    wpstorecart WordPress plugin through 5.0.7 contains an insecure deserialization vulnerability caused by direct unauthenticated access to a bundled add-on that deserializes user input without class restrictions, letting unauthenticated attackers inject arbitrary PHP objects, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-84047 No auth

    Album Cover Finder WordPress - SQL Injection

    Album Cover Finder WordPress plugin <= 0.7.0 contains a sql injection caused by improper sanitization and escaping of a parameter in SQL query, letting unauthenticated attackers execute arbitrary SQL commands remotely.

  • 9.9 /10 Critical
    CVE-2026-82845 Auth required

    Masteriyo LMS WordPress plugin - Insecure Deserialization

    Masteriyo LMS WordPress plugin < 3.4.1 contains an insecure deserialization vulnerability caused by user-supplied metadata being deserialized, letting attackers with minimal accounts execute arbitrary code or write files, exploit requires user account.

  • 8.8 /10 High
    CVE-2026-81742 No auth

    BE REST Endpoints WordPress - Stored XSS

    BE REST Endpoints WordPress plugin through 1.0.0 contains a stored XSS caused by lack of authorization and input sanitization in widget operations, letting unauthenticated attackers execute arbitrary scripts in users' browsers.

  • 7.1 /10 High
    CVE-2026-81429 No auth

    WPBakery Page Builder - Stored XSS

    WPBakery Page Builder WordPress plugin <= 1.0.2 contains a stored cross-site scripting caused by lack of CSRF check and unsanitized template-import data, letting attackers execute script in administrator session via forged request.

  • 9.8 /10 Critical
    CVE-2026-81402 No auth

    DS Ad Rotator WordPress - Unrestricted File Upload

    DS Ad Rotator WordPress plugin through 0.8 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation in the image upload handler, letting unauthenticated attackers upload arbitrary files including PHP, leading to remote code execution.

  • 7.2 /10 High
    CVE-2026-81090 Auth required

    Gpx2Graphics WordPress Plugin - Cross Site Request Forgery & Remote Code Execution

    Gpx2Graphics WordPress plugin through 0.3 contains a cross site request forgery vulnerability caused by lack of CSRF check and file type validation in file upload handling, letting logged-in administrators upload arbitrary files leading to remote code execution.

  • 8.6 /10 High
    CVE-2026-80494 No auth

    Yogeta WP Cloud WordPress - Path Traversal

    Yogeta WP Cloud WordPress plugin through 1.0 contains a path traversal caused by lack of validation of user-supplied file path in a public endpoint, letting unauthenticated attackers download arbitrary files including sensitive credentials.

  • 8.6 /10 High
    CVE-2026-80491 No auth

    SAMO Forms WordPress - SQL Injection

    SAMO Forms WordPress plugin through 1.0.0 contains a SQL injection caused by improper sanitization and escaping of user input in several unauthenticated actions, letting unauthenticated attackers execute arbitrary SQL queries.

  • 8.8 /10 High
    CVE-2026-78175 CISA KEVAuth required

    Tutor LMS - Remote Code Execution

    Tutor LMS WordPress plugin <= 4.0.7 contains a PHP Object Injection caused by improper handling of the withdraw_method_field parameter in tutor_save_withdraw_account AJAX handler, letting authenticated attackers with subscriber access or higher achieve remote code execution, exploit requires monetization feature enabled and user registration allowed.

  • 9.8 /10 Critical
    CVE-2026-78159 CISA KEVPoC publicNo auth

    The Events Calendar WordPress plugin - Remote Code Execution

    The Events Calendar WordPress plugin <= 6.17.3 contains a remote code execution caused by insufficient validation of the widget 'classes' map in parse_array, letting unauthenticated attackers execute code remotely, exploit requires comments enabled on tribe_events posts with crafted wp:legacy-widget block comment.

  • 9.8 /10 Critical
    CVE-2026-78006 CISA KEVPoC publicNo auth

    The Events Calendar WordPress Plugin - Remote Code Execution

    The Events Calendar WordPress plugin <= 6.17.4 contains a remote code execution vulnerability caused by insufficient protection in is_safe_widget_instance and forged wp_hash integrity attribute, letting unauthenticated attackers execute code remotely, exploit requires comments enabled and visible on events.

  • 7.2 /10 High
    CVE-2026-77752 Auth required

    Temporary Login Without Password WordPress - Broken Access Control

    Temporary Login Without Password WordPress plugin < 1.9.9 contains a broken access control caused by missing verification of network super admin rights, letting site administrators escalate privileges to network super admin, exploit requires attacker to be a site administrator.