Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 827 of 891

  • 8.1 /10 High
    CVE-2026-81801 Auth required

    WP-Stateless - Broken Access Control

    WP-Stateless <= 4.4.1 contains a subscriber settings change vulnerability caused by improper handling of subscriber settings, letting attackers modify subscriber configurations, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-81800 No auth

    Verified Reviews (Avis Vérifiés) - SQL Injection

    Verified Reviews (Avis Vérifiés) <= 2.4.6 contains an unauthenticated SQL injection caused by improper input sanitization, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81799 No auth

    Return Refund and Exchange For WooCommerce - Broken Access Control

    Return Refund and Exchange For WooCommerce <= 4.6.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 7.3 /10 High
    CVE-2026-81796 No auth

    WP Travel - Authentication Bypass

    WP Travel <= 12.0.3 contains a broken authentication vulnerability allowing unauthenticated attackers to bypass authentication, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-81795 No auth

    Page Visits Counter - Lite - Reflected XSS

    Page Visits Counter - Lite <= 1.2.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81794 No auth

    Shirt Product Designer for WooCommerce - Broken Access Control

    Shirt Product Designer for WooCommerce 1.0.4 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.6 /10 High
    CVE-2026-81789 No auth

    Advanced Product Fields Extended for WooCommerce - Unrestricted File Deletion

    Advanced Product Fields Extended for WooCommerce <= 3.1.6 contains an unrestricted file deletion vulnerability caused by improper input validation, letting unauthenticated attackers delete arbitrary files remotely, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-81786 No auth

    Thank You Page Customizer for WooCommerce - Broken Access Control

    Thank You Page Customizer for WooCommerce <= 1.2.2 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.1 /10 High
    CVE-2026-81784 No auth

    Wise Chat - Insecure Deserialization

    Wise Chat <= 3.4 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-81783 Auth required

    MailMunch - Authentication Bypass

    MailMunch <= 3.2.5 contains a broken authentication vulnerability in Subscriber component, letting attackers bypass authentication mechanisms, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-81554 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers obtain sensitive information.

  • 8.8 /10 High
    CVE-2026-81551 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers write or delete files on shared storage.

  • 8.8 /10 High
    CVE-2026-81550 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.5 /10 High
    CVE-2026-81540 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of file paths, letting remote authenticated attackers overwrite ruleset files of other tenants.

  • 9.1 /10 Critical
    CVE-2026-81468 Auth required

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.