Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 158 of 681

  • 7.2 /10 High
    CVE-2026-109317 Auth required

    Grav grav-plugin-api - Privilege Escalation

    Grav grav-plugin-api < 1.0.36 contains a privilege escalation caused by storing positive scalar admin or API parent grants, letting delegated user managers obtain super-admin access, exploit requires api.users.write permission.

  • 7.3 /10 High
    CVE-2026-109314 Auth required

    Grav Login - Information Disclosure & Broken Access Control

    Grav Login plugin < 3.9.9 contains an information disclosure vulnerability caused by authoring a page at the reset route, letting publishers obtain password-reset tokens and usernames, exploit requires publisher privileges.

  • 8.1 /10 High
    CVE-2026-109313 Auth required

    Grav Login plugin - Authentication Bypass

    Grav Login plugin < 3.9.9 contains an authentication bypass caused by remember-me cookie restoration, letting attackers with valid password skip two-factor authentication, exploit requires valid password.

  • 8.1 /10 High
    CVE-2026-109312 Auth required

    Grav Login plugin - Authentication Bypass

    Grav Login plugin > 2.7.0 < 3.9.9 contains an authentication bypass caused by incomplete verification of pending front-end 2FA sessions in processUserProfile(), letting attackers with victim's password disable 2FA and take over accounts, exploit requires ability to publish page form without access rule.

  • 8.8 /10 High
    CVE-2026-109308 Auth required

    Craft CMS - Remote Code Execution

    Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains a remote code execution caused by passing raw 'updates' parameter without cleansing in AppController::actionCacheUpdates, letting authenticated control panel users with performUpdates permission or Updates-utility access execute arbitrary code via behavior and event-handler injection.

  • 8.8 /10 High
    CVE-2026-109305 Auth required

    Craft CMS - Template Injection

    Craft CMS > 5.10.2 < 5.10.14 contains a template injection caused by a Twig sandbox bypass allowing non-admin users with System Messages permission to invoke PHP callables, letting them execute code as the web user.

  • 7.3 /10 High
    CVE-2026-109291 Auth required

    Open WebUI - Stored XSS

    Open WebUI > 0.6.33 < 0.11.4 contains a stored XSS caused by storing javascript: URLs in citation embed_url fields, letting authenticated attackers execute scripts in victims' sessions and steal tokens, exploit requires user authentication.

  • 7.3 /10 High
    CVE-2026-109290 Auth required

    Open WebUI - Stored XSS

    Open WebUI >0.11.1 <0.11.4 contains a stored cross-site scripting caused by crafted DOCX attachments in DocxPreview.svelte, letting authenticated attackers execute scripts to steal admin session tokens.

  • 8.1 /10 High
    CVE-2026-109286 No auth

    Open WebUI - Cross-Site Request Forgery

    Open WebUI >0.7.0 <0.11.4 contains a cross-origin message handling vulnerability caused by unvalidated verify:chat messages in SyncStatsModal, letting remote attackers steal session tokens, exploit requires crafted cross-origin messages.

  • 7.1 /10 High
    CVE-2026-109242 No auth

    FreeRDP - Information Disclosure & Denial of Service

    FreeRDP < 3.0.0 and 3.6.0 < 3.32.0 contain an information disclosure and denial of service caused by uninitialized heap memory rendering in progressive tiles, letting malicious RDP servers leak memory or crash clients, exploit requires malicious server interaction.

  • 8.6 /10 High
    CVE-2026-109238 No auth

    Crawl4AI - Server-Side Request Forgery

    Crawl4AI < 0.9.4 contains a server-side request forgery caused by enabling link_preview_config on /crawl requests, letting API clients access internal addresses, exploit requires crafted API requests with specific parameters.

  • 8.1 /10 High
    CVE-2026-109237 Auth required

    Crawl4AI - Authentication Bypass

    Crawl4AI 0.9.0 before 0.9.4 contains an untrusted-config gate bypass caused by wrapping forbidden config objects in dict-type wrappers, letting non-admin API clients read secret keys and forge admin JWTs, exploit requires non-admin API access.

  • 7.5 /10 High
    CVE-2026-109229 No auth

    SGLang - Denial of Service

    SGLang through 0.5.21 contains a denial of service vulnerability caused by disabling Pillow decompression bomb protection in NanoNemotronVLImageProcessor, letting remote attackers exhaust memory by submitting highly compressed large images, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-109228 No auth

    SGLang - Denial of Service

    SGLang through 0.5.21 contains a denial of service caused by resource budget bypass via manipulation of fps, max_frames, max_tokens_per_frame, and max_image_tokens in video_url, letting remote attackers exhaust worker memory, exploit requires crafted video_url parameters.

  • 7.5 /10 High
    CVE-2026-109227 No auth

    SGLang - Denial of Service

    SGLang through 0.5.21 contains a denial of service caused by unbounded memory allocation in preprocess_video in qwen_vl.py, letting remote attackers exhaust worker memory by submitting high-resolution videos, exploit requires network access.