Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 818 of 891
- 8.1 /10 HighCVE-2026-49464 Auth required
NL Portal Backend Libraries nl.nl-portal:taak - Broken Access Control
NL Portal Backend Libraries nl.nl-portal:taak 1.5.0 through 3.0.0 contains a broken access control vulnerability caused by failure to verify ownership in submitTaakV2 GraphQL mutation, letting authenticated users read, overwrite, and complete other users' tasks, exploit requires authentication.
- 8.1 /10 HighCVE-2026-38058 Auth required
iDirect iQ200 VSAT terminal - Authentication Bypass
iDirect iQ200 VSAT terminal contains an information disclosure vulnerability caused by returning complete device configuration including MD5-crypt password hashes in the SECURITY section, letting authenticated users extract and crack password hashes offline, exploit requires valid web credentials.
- 8.8 /10 HighCVE-2026-38056 Auth required
iDirect iQ200 - Privilege Escalation
iDirect iQ200 VSAT terminal firmware 23.0.1.0 contains a local privilege escalation caused by insufficient privilege restrictions on a pre-configured low-privilege local user account, letting local attackers gain administrative control, exploit requires access to the built-in low-privilege account.
- 8.1 /10 HighCVE-2026-19991 Auth required
UsersWP WordPress Plugin - Arbitrary File Deletion
UsersWP WordPress plugin <= 1.2.70 contains an arbitrary file deletion vulnerability caused by improper validation and normalization of file paths in upload_file_remove() AJAX handler, letting authenticated subscribers delete arbitrary files.
- 7.2 /10 HighCVE-2026-18579 No auth
WP Photo Album Plus - Stored XSS
WP Photo Album Plus for WordPress <= 9.2.08.003 contains a stored cross-site scripting caused by insufficient sanitization of 'HTTP_X_FORWARDED_FOR' parameter, letting unauthenticated attackers inject scripts executed on user page access.
- 7.5 /10 HighCVE-2026-18561 No auth
Unlimited Elements For Elementor - SQL Injection
Unlimited Elements For Elementor for WordPress <= 2.0.16 contains a SQL injection caused by insufficient escaping of the 'addontype' parameter in getWhereString(), letting unauthenticated attackers extract sensitive database information, exploit requires crafted array input.
- 7.2 /10 HighCVE-2026-17037 No auth
Kirki Freeform Page Builder - Stored XSS
Kirki Freeform Page Builder plugin for WordPress <= 6.2.0 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in the 'comment' parameter, letting unauthenticated attackers inject and execute arbitrary scripts when users access the page.
- 7.5 /10 HighCVE-2026-15462 No auth
Sticky Chat Widget WordPress - SQL Injection
Sticky Chat Widget WordPress plugin <= 1.4.2 contains a SQL injection caused by unsanitized 'scw_form_fields' parameter array keys in 'scw_save_form_data' AJAX action, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-14563 No auth
advanced-customized-prompts WordPress - Authentication Bypass
advanced-customized-prompts WordPress plugin through 1.0.1 contains an authentication bypass caused by lack of password verification before issuing authenticated sessions, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-14560 No auth
teddy-bear-customize-addon WordPress - Unrestricted File Upload
teddy-bear-customize-addon WordPress plugin through 1.0.5 contains an unrestricted file upload vulnerability caused by improper validation of uploaded files relying on client-supplied content type and original filename, letting unauthenticated attackers upload and execute arbitrary PHP code on the server, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-14559 No auth
teddy-bear-customize-addon WordPress - Authentication Bypass
teddy-bear-customize-addon WordPress plugin through 1.0.5 contains a broken authentication caused by lack of password verification before user authentication, letting unauthenticated attackers log in as any registered user by supplying only the user's email address.
- 7.3 /10 HighCVE-2025-15679
BMC - Authentication Bypass
BMC contains a broken authentication caused by the root account being activated without a password after a factory reset, letting attackers gain unauthorized access, exploit requires factory reset operation.
- 7.5 /10 HighCVE-2026-9166 No auth
GIS Informatics GisLab Laboratory Management System - Path Traversal
GIS Informatics GisLab Laboratory Management System >= 1.4.03 < 1.5 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers access unauthorized files, exploit requires crafted request.
- 9.8 /10 CriticalCVE-2026-9163 No auth
GIS Informatics GisLab Laboratory Management System - SQL Injection
GIS Informatics GisLab Laboratory Management System >= 1.4.03 and < 1.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.9 /10 CriticalCVE-2026-89094 Auth required
Forgejo - Remote Code Execution
Forgejo < 16.0.4 contains a remote code execution caused by mishandled template expansion in .forgejo/template files, letting remote attackers execute arbitrary code, exploit requires crafted template repository.