Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 155 of 681

  • 8.8 /10 High
    CVE-2026-109608 Auth required

    Frappe ERPNext - SQL Injection

    Frappe ERPNext < 15.121.0 and 16.x < 16.34.0 contains an SQL injection caused by lack of input validation in several endpoints, letting authenticated users read sensitive information and escalate privileges, exploit requires authentication.

  • 7.3 /10 High
    CVE-2026-109604 Auth required

    Frappe ERPNext - Stored XSS

    Frappe ERPNext < 15.112.0 and 16.x < 16.23.0 contains a stored XSS caused by unescaped interpolation of stored record names in a tool view, letting authenticated users execute scripts in other users' sessions.

  • 9.8 /10 Critical
    CVE-2026-109575 No auth

    HAProxy Data Plane API - Authentication Bypass

    HAProxy Data Plane API 2.2.0 through 3.4.3 contains a broken authentication caused by process-global authentication logic improperly dropping security controls across multiple transport types, letting unauthenticated attackers bypass credentials and gain full API administrative access, exploit requires attacker to reach HTTP or UNIX management endpoints.

  • 8.1 /10 High
    CVE-2026-109573 No auth

    phpMyFAQ - SQL Injection

    phpMyFAQ < 4.1.9 contains an SQL injection caused by improper escaping in PdoMysql::escape() under NO_BACKSLASH_ESCAPES mode, letting unauthenticated attackers read, modify, or delete database records via api/autocomplete search parameter.

  • 7.6 /10 High
    CVE-2026-109572 Auth required

    Open WebUI - Privilege Escalation

    Open WebUI >0.8.6 <0.11.4 contains a privilege escalation caused by shared key exposure in terminal proxy, letting authenticated users access Terminals administrator API to control other users' terminals, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-109569 Auth required

    sandboxed.sh - Container Escape

    sandboxed.sh <= 1.3.0 contains a container escape vulnerability caused by nsenter attaching without --root, letting agent-run code in container workspaces read and modify host filesystem, exploit requires agent code execution in container.

  • 7.1 /10 High
    CVE-2026-109568 Auth required

    Shaark - Broken Access Control

    Shaark 1.2.13 through 1.2.44 contains a broken access control vulnerability caused by missing ownership checks in Link, Story, Chest, and Album API controllers, letting authenticated non-admin users overwrite or delete other users' content via PUT or DELETE requests.

  • 7.2 /10 High
    CVE-2026-109567 Auth required

    Rapyd Admin - Broken Access Control

    Rapyd Admin 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component, letting users with edit users permission assign themselves the admin role, exploit requires edit users permission.

  • 9.8 /10 Critical
    CVE-2026-109566 No auth

    Rapyd Admin - Authentication Bypass

    Rapyd Admin 9.0.0 before 9.20.0 contains a hardcoded credentials vulnerability caused by an AuthSeeder-created admin@laravel account with password admin, letting remote unauthenticated attackers gain super-admin access, exploit requires no special conditions.

  • 7.5 /10 High
    CVE-2026-109563 No auth

    N3.js - Denial of Service

    N3.js < 2.11.1 contains a regular expression denial of service caused by quadratic backtracking in N3Lexer number pattern, letting attackers supply crafted input to block the Node.js event loop, exploit requires attacker to provide untrusted input.

  • 7.5 /10 High
    CVE-2026-109560 No auth

    Continue CLI - Permission Bypass

    Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass caused by chaining unapproved commands after allowed Bash prefix rules, letting attackers execute arbitrary code as the user, exploit requires command injection via repository files or fetched pages.

  • 8.7 /10 High
    CVE-2026-109559 Auth required

    EdgeEver Desktop - Broken Access Control

    EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass caused by string-prefix URL matching in the main window, letting attackers load arbitrary origins and access session tokens, exploit requires crafted URL with userinfo syntax.

  • 8.7 /10 High
    CVE-2026-109558 Auth required

    EdgeEver - Stored XSS

    EdgeEver 1.6.0 through 1.112.0 contains a stored XSS caused by rendering template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization in TemplatesPane.tsx, letting attackers run scripts and access privileged bridge, exploit requires API or MCP token access.

  • 8.7 /10 High
    CVE-2026-109557 Auth required

    EdgeEver - Stored XSS

    EdgeEver through 1.112.0 contains a stored XSS caused by injection through notebook names or memo titles in setMemoDragPreview, letting attackers execute scripts with access to desktop bridge session token, exploit requires attacker to set malicious names.

  • 8.0 /10 High
    CVE-2026-109556 Auth required

    EdgeEver Desktop - Remote Code Execution

    EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability caused by lack of sender check in desktop:acp-probe IPC handler, letting attackers with script execution launch local executables with user privileges, exploit requires script execution in renderer.