Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 114 of 677
- 7.1 /10 HighCVE-2026-63172 Auth required
Omnispace Agora Project - Broken Access Control
Omnispace Agora Project < 26.10.0 contains a broken access control vulnerability caused by missing function-level authorization check in actionVueEditUser, letting non-administrative users create unauthorized accounts, exploit requires user authentication.
- 8.1 /10 HighCVE-2026-63165 Auth required
Omnispace Agora Project - SQL Injection
Omnispace Agora Project < 26.10.0 contains a SQL injection caused by unsanitized manipulation of the sortEvents parameter in calendar functionality, letting attackers extract database information via error-based techniques, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-63163 No auth
Omnispace Agora Project - Broken Access Control
Omnispace Agora Project < 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route caused by use of md5(filename) token instead of proper authorization, letting unauthenticated attackers download arbitrary files, exploit requires guessing file names.
- 8.8 /10 HighCVE-2026-63162 Auth required
Omnispace Agora Project - Path Traversal
Omnispace Agora Project < 26.10.0 contains a path traversal vulnerability caused by unanchored tmpFolderName in upload destination path, letting attackers write arbitrary files and achieve remote code execution, exploit requires crafted tmpFolderName value.
- 8.8 /10 HighCVE-2026-63161 No auth
Omnispace Agora Project - Authentication Bypass
Omnispace Agora Project < 26.10.0 contains a session fixation vulnerability caused by failure to regenerate session ID upon authentication, letting remote attackers hijack authenticated sessions, exploit requires victim login.
- 7.4 /10 HighCVE-2026-63160 No auth
Omnispace Agora Project - Authentication Bypass
Omnispace Agora Project < 26.10.0 contains a broken authentication caused by storing persistent remember-me tokens verbatim server-side, letting attackers with token access authenticate as victim users, exploit requires token disclosure.
- 7.4 /10 HighCVE-2026-63159 No auth
Omnispace Agora Project - Authentication Bypass
Omnispace Agora Project < 26.10.0 contains a broken authentication caused by predictable password-reset tokens computed as sha1(login.password), letting unauthenticated attackers hijack user accounts, exploit requires knowledge or guess of login and password.
- 7.4 /10 HighCVE-2026-63158 No auth
Omnispace Agora Project - Authentication Bypass
Omnispace Agora Project < 26.10.0 contains an authentication bypass caused by legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating stored bcrypt password hashes as bearer credentials, letting attackers impersonate users including admins, exploit requires possession of stored password hash.
- 8.8 /10 HighCVE-2026-63154 Auth required
Omnispace Agora Project - Authentication Bypass
Omnispace Agora Project < 26.10.0 contains a SQL injection caused by unvalidated agoraFields[] names as SQL column identifiers during user import, letting space administrators escalate privileges, exploit requires space administrator access.
- 8.1 /10 HighCVE-2026-63153 Auth required
Omnispace Agora Project - Broken Access Control
Omnispace Agora Project < 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to assign access rights to unauthorized spaces, breaking tenant isolation.
- 8.1 /10 HighCVE-2026-63152 Auth required
Omnispace Agora Project - SQL Injection
Omnispace Agora Project < 26.10.0 contains a second-order SQL injection caused by improper parameterization of _idCategoryFilter in app/Common/MdlCategory.php, letting authenticated attackers execute malicious SQL, exploit requires authentication.
- 7.4 /10 HighCVE-2026-63149 No auth
Omnispace Agora Project - Authentication Bypass
Omnispace Agora Project < 26.10.0 contains an insecure randomness vulnerability caused by predictable password generation using PHP's uniqid() function, letting attackers predict temporary passwords and take over accounts, exploit requires attacker to know or approximate account creation time.
- 9.8 /10 CriticalCVE-2026-63146 No auth
Omnispace Agora Project - Remote Code Execution
Omnispace Agora Project < 26.10.0 contains a code injection vulnerability caused by unescaped attacker-controlled values written into config.inc.php combined with SQL injection via PDO::ATTR_EMULATE_PREPARES, letting unauthenticated attackers execute remote code, exploit requires ability to trigger installer.
- 7.0 /10 HighCVE-2026-62840 Auth required
Linux Kernel - Privilege Escalation
Linux Kernel contains a TOCTOU race condition caused by improper synchronization, letting authorized local attackers elevate privileges, exploit requires local access with authorization.
- 7.8 /10 HighCVE-2026-61931 Auth required
Windows Perception Simulation Service - Privilege Escalation
Windows Perception Simulation Service contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory corruption.