Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 161 of 681

  • 7.3 /10 High
    CVE-2026-108819 No auth

    agno-agi agno - Command Injection

    agno-agi agno <= 3.0.6/3.1.1 contains a command injection caused by manipulation of the "code" argument in Agent Orchestration Layer exec function, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108818 No auth

    agno-agi agno - Authentication Bypass

    agno-agi agno <= 2.7.3/3.0.6 contains an authentication bypass caused by manipulation of the "security_key" argument in get_authentication_dependency function of auth.py, letting remote attackers bypass authentication, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108807 No auth

    krupalshah EmployeeRecruitmentSystem - SQL Injection

    krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe contains an SQL injection caused by manipulation of input in mysql_query function in source/adminregister.php Registration Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108806 No auth

    krupalshah EmployeeRecruitmentSystem - SQL Injection

    krupalshah EmployeeRecruitmentSystem contains a sql injection caused by manipulation of the "fpemail" argument in source/authprocessing.php Forgot Password Handler, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-108805 No auth

    krupalshah EmployeeRecruitmentSystem - SQL Injection

    krupalshah EmployeeRecruitmentSystem contains a sql injection caused by manipulation of email/password arguments in mysql_query function of Login Handler, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-108804 No auth

    TRENDnet TEW-751DR/TEW-752DRU/TEW733GR - Command Injection

    TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR 1.03B01/1.03B03 contain a command injection caused by manipulation of the "service" argument in pigwidgeon.cgi fwrite function of the Web Management Backend, letting remote attackers execute OS commands, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-108799 No auth

    jackq XCMS - SQL Injection

    jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261 contains a SQL injection caused by manipulation of the "email" argument in PublicController::sendFindPwdMail of Password Recovery Mail Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-108798 No auth

    ZKTeco BioTime - Weak Cryptography

    ZKTeco BioTime 9.5.6 Build 20260130.3206 contains a hardcoded cryptographic key vulnerability caused by use of hard-coded cryptographic key in unknown processing, letting remote attackers potentially compromise cryptographic security, exploit requires remote access.

  • 7.3 /10 High
    CVE-2026-108783 No auth

    PRVTPRO Amnezia-Web-Panel - Authentication Bypass

    PRVTPRO Amnezia-Web-Panel <= 1.6.2/1.7.2 contains a broken authentication caused by use of default credentials in Backup Download component, letting remote attackers gain unauthorized access, exploit requires no special privileges.

  • 7.4 /10 High
    CVE-2026-108481 No auth

    Patreon Patreon WordPress - Cross Site Request Forgery

    Patreon Patreon WordPress patreon-connect <= 1.10.0 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 8.1 /10 High
    CVE-2026-108479 No auth

    Patreon WordPress - Cross Site Request Forgery

    Patreon WordPress patreon-connect <= 1.9.17 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 9.1 /10 Critical
    CVE-2026-108362

    Privasys Remote Attestation TLS Clients - Authentication Bypass

    Privasys Remote Attestation TLS Clients < 0.11.0 contains an authentication bypass caused by acceptance of TEE attestation evidence without explicit platform identity authorization, letting network attackers impersonate attested TLS endpoints, exploit requires forged evidence or extracted attestation secrets.

  • 7.2 /10 High
    CVE-2026-108361 Auth required

    Privasys Remote Attestation TLS Clients - Authentication Bypass

    Privasys Remote Attestation TLS Clients < 0.9.1 contains a broken authentication caused by attestation performed only once at connection establishment, letting local attackers modify workload state during connection lifetime, exploit requires local access.

  • 7.8 /10 High
    CVE-2026-108094 Auth required

    Mutter - Use After Free

    Mutter contains a use-after-free vulnerability caused by asynchronous ICC file read handling in the Wayland color-management ICC image-description path, letting local attackers executing malicious Wayland clients cause crashes or arbitrary code execution.

  • 7.1 /10 High
    CVE-2026-105668 Auth required

    Hexpm hex - Protection Mechanism Failure

    Hexpm hex 2.5.0 to < 2.5.2 contains a protection mechanism failure caused by improper cooldown bypass logic in package release handling, letting package owners or attackers who compromise owners bypass release-age cooldown, exploit requires package ownership or account compromise.