Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 849 of 891

  • 7.8 /10 High
    CVE-2026-21086 Auth required

    ProxyHandler - Broken Access Control

    ProxyHandler prior to SMR Aug-2026 Release 1 contains an improper authorization vulnerability caused by insufficient access control, letting local attackers access proxy configuration, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-19201 No auth

    Google go-attestation - Denial of Service

    Google go-attestation <= 0.6.1 contains a denial of service caused by uncontrolled recursion in the Windows SIPA event log parser's readELAMAggregation function, letting attackers crash the verifier via crafted nested elamAggregation events, exploit requires crafted Windows event log input.

  • 8.1 /10 High
    CVE-2026-18147 No auth

    FreeIPA - Stored XSS

    FreeIPA contains a stored XSS caused by DOM manipulation in the Web UI password reset page, letting unauthenticated remote attackers execute arbitrary JavaScript via crafted links, exploit requires victim interaction.

  • 7.2 /10 High
    CVE-2026-17553 Auth required

    WP EasyCart - Privilege Escalation

    WP EasyCart <= 5.9.3 contains a privilege escalation caused by insecure update_option() calls in ec_ajax_save_page_default_options() AJAX handler, letting authenticated Store Manager-level users escalate to administrator by modifying WordPress options, exploit requires authenticated user with Store Manager or higher privileges.

  • 7.5 /10 High
    CVE-2026-16960 No auth

    Loops & Logic WordPress - Information Disclosure

    Loops & Logic WordPress plugin < 4.3.0 contains an information disclosure vulnerability caused by insufficient restriction on public template-data action, letting unauthenticated users read arbitrary user records and site options, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-16272 No auth

    PayTR Virtual Pos iFrame API WHMCS Module - Authentication Bypass

    PayTR Virtual Pos iFrame API (v9x) WHMCS Module >= 9.0.0 < 9.0.3 contains a use of less trusted source vulnerability caused by improper validation of trusted identifiers, letting attackers exploit trusted identifiers, exploit requires crafted requests.

  • 7.7 /10 High
    CVE-2026-15913 Auth required

    Fortra GoAnywhere MFT - Path Traversal

    Fortra GoAnywhere MFT < 7.10.2 contains a path traversal caused by improper validation in /attachRemoteFiles endpoint, letting web users with Secure Folders and Secure Mail permissions read arbitrary files outside their sandbox, exploit requires specific permissions.

  • 7.5 /10 High
    CVE-2026-15667 PoC publicAuth required

    Eventin WordPress Plugin - Local File Inclusion

    Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated contributors execute arbitrary PHP code, exploit requires contributor-level access.

  • 7.5 /10 High
    CVE-2026-15406 Auth required

    Eventin WordPress Plugin - Local File Inclusion

    Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin <= 4.1.22 contains a local file inclusion caused by improper sanitization of 'event_layout' parameter, letting authenticated attackers with custom-level access include and execute arbitrary PHP files, exploit requires authenticated user with custom-level access or higher.

  • 7.2 /10 High
    CVE-2026-14989 No auth

    WPLP Cookie Consent - Stored XSS

    WPLP Cookie Consent plugin for WordPress <= 4.4.1 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'wpl_user_preference' parameter, letting unauthenticated attackers inject and execute arbitrary scripts, exploit requires no authentication.

  • 8.6 /10 High
    CVE-2026-14962 PoC publicNo auth

    ELEX WooCommerce Request a Quote - SQL Injection

    ELEX WooCommerce Request a Quote WordPress plugin < 2.4.1 contains a SQL injection caused by improper sanitization and escaping of a parameter in a SQL query, letting unauthenticated attackers extract arbitrary data from the database.

  • 8.8 /10 High
    CVE-2026-14359 CISA KEVAuth required

    YITH WooCommerce Waitlist Premium - Privilege Escalation

    YITH WooCommerce Waitlist Premium <= 3.35.0 contains a privilege escalation caused by missing capability check and nonce verification in add_user_in_waiting_list() function, letting authenticated attackers with Subscriber-level access create admin users.

  • 7.2 /10 High
    CVE-2026-13359 No auth

    BestWebSoft Contact Form to DB - Stored XSS

    BestWebSoft Contact Form to DB plugin for WordPress <= 1.7.5 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in cntctfrm_contact_dropdown parameter, letting unauthenticated attackers execute scripts in administrator sessions via message manager page, exploit requires unauthenticated contact form submission.

  • 8.2 /10 High
    CVE-2026-12855 Auth required

    HP Projects - Buffer Overflow

    HP projects contain a buffer overflow caused by unvalidated memory boundaries in custom code, letting attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2024-58382 No auth

    league/commonmark - Denial of Service

    league/commonmark < 2.6.0 contains a denial of service caused by polynomial time complexity in Markdown parsing, letting attackers exhaust CPU and PHP-FPM resources, exploit requires crafted Markdown inputs.