Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 793 of 891
- 7.2 /10 HighCVE-2026-77705 Auth required
Booking for Appointments and Events Calendar WordPress plugin - Broken Access Control
Booking for Appointments and Events Calendar WordPress plugin < 2.4.10 contains a broken access control vulnerability caused by lack of verification on user entitlement when editing linked WordPress accounts, letting users with customer or employee management permissions modify other users' passwords and emails to take over accounts, exploit requires user to have customer or employee management permissions.
- 9.6 /10 CriticalCVE-2026-77006 Auth required
WebTotem Backups WordPress Plugin - Unrestricted File Deletion
WebTotem Backups WordPress plugin through 1.0.1 contains an unrestricted file deletion vulnerability caused by lack of file path validation, capability checks, and CSRF enforcement, letting authenticated users delete arbitrary files, exploit requires user authentication.
- 9.6 /10 CriticalCVE-2026-77005 Auth required
CODE MONKEYS PROPOSALS WordPress - Broken Access Control
CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 contains a broken access control caused by lack of user capability checks and file path validation before file deletion, letting authenticated users delete arbitrary files, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-75800 No auth
Frontegg SAML SSO WordPress plugin - Authentication Bypass
Frontegg SAML SSO WordPress plugin <= 1.0.1 contains a broken authentication caused by lack of signature and issuer verification in SAML responses, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-16482 No auth
rtMedia for WordPress - SQL Injection
rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 contains a time-based blind SQL Injection caused by insufficient escaping of the 'compare' parameter in SQL queries, letting unauthenticated attackers extract sensitive database information, exploit requires a public page with rtMedia shortcode and crafted rtmedia_shortcode GET parameter.
- 8.8 /10 HighCVE-2026-15451 Auth required
MemberPress Corporate Accounts - Privilege Escalation
MemberPress Corporate Accounts WordPress plugin <= 1.5.39 contains a privilege escalation caused by mass assignment in 'add_sub_account_user' passing unfiltered 'userdata' to 'wp_insert_user', letting authenticated corporate account users escalate privileges, exploit requires subscriber-level access or higher.
- 7.6 /10 HighCVE-2026-90460 Auth required
OpenStack Keystone - Broken Access Control
OpenStack Keystone < 29.0.3 contains a broken access control vulnerability caused by delegated authentication tokens not being properly restricted in /v3/credentials API, letting attackers create, modify, delete credentials and read sensitive secrets, exploit requires use of delegated authentication tokens.
- 8.1 /10 HighCVE-2026-90456 No auth
Inventory-Management Component - Authentication Bypass
An inventory-management component contains a broken authentication caused by a fixed, publicly-known administrative password in the example environment-configuration file, letting attackers access the administrative interface, exploit requires deployment without running setup routine.
- 8.8 /10 HighCVE-2026-90444 Auth required
Generic File-Transfer Interface - Command Injection
A file-transfer interface requiring valid credentials contains a command injection caused by insufficient sanitization of attacker-controlled filenames, letting authenticated attackers execute arbitrary OS commands with process privileges.
- 7.8 /10 HighCVE-2026-89771 Auth required
Linux Kernel - Race Condition
Linux kernel contains a race condition in ring buffer subbuffer resizing caused by concurrent access to trace_buffer subbuf_size, letting attackers cause data corruption or denial of service, exploit requires concurrent ring buffer access.
- 7.4 /10 HighCVE-2026-89769 No auth
Linux kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by an IRQ leak on cpuhp_setup_state error path in clocksource/drivers/nxp-pit, letting attackers potentially trigger use-after-free via IRQ firing, exploit requires kernel IRQ handling.
- 7.8 /10 HighCVE-2026-89767 Auth required
Linux Kernel overlayfs - Denial of Service
Linux kernel overlayfs contains a double end_creating() call caused by casefold-mismatch in ovl_create_real(), letting unprivileged users cause a deadlock by unlocking a lock twice during directory creation, exploit requires unprivileged user access.
- 7.8 /10 HighCVE-2026-89764
Linux Kernel - Use After Free
Linux kernel contains a use-after-free caused by a race condition between concurrent revokers in rust devres component, letting attackers cause memory corruption, exploit requires concurrent revocation attempts.
- 7.8 /10 HighCVE-2026-89763 Auth required
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by improper TPM teardown ordering in trusted_tpm_exit(), letting local attackers cause memory corruption or kernel crash, exploit requires local code execution.
- 7.8 /10 HighCVE-2026-89762
Linux Kernel AppArmor - Use After Free
Linux kernel AppArmor contains a use-after-free vulnerability caused by improper cred replacement in begin_current_label_crit_section(), letting attackers cause UAF via out-of-sync credentials during LSM hooks, exploit requires specific task cred override conditions.