Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 189 of 681
- 9.1 /10 CriticalCVE-2026-108266
Privasys rustls - Man-in-the-Middle
Privasys rustls before v0.8.1 contains a replay attack vulnerability caused by RA-TLS challenge certificates binding quote ReportData to public key and client nonce but not active TLS session, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108265
Enclave OS Mini - Authentication Bypass
Enclave OS Mini prior to wasm-v0.40.0 contains a replay attack vulnerability caused by omission of a value bound to the active TLS session in RA-TLS challenge certificate path, letting attackers relay genuine quotes to impersonate enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108264 Auth required
Wizarr - Remote Code Execution & Stored XSS
Wizarr prior to 2026.9.1 contains a remote code execution caused by unsafe evaluation of Markdown in a non-sandboxed Jinja2 environment, letting authenticated users or admins execute arbitrary Python and OS commands, exploit requires authenticated user or admin importing untrusted bundles.
- 9.9 /10 CriticalCVE-2026-108263 Auth required
Astron Agent - Remote Code Execution
Astron Agent < 1.1.2 contains a remote code execution caused by default use of LocalExecutor without sandbox restrictions in dynamic code execution, letting authenticated low-privilege tenants execute code as root and bypass tenant checks.
- 9.3 /10 CriticalCVE-2026-108261 No auth
TinaCMS - Broken Access Control
TinaCMS < 3.14.0 and @tinacms/app < 2.5.14 contain a broken access control vulnerability caused by improper origin validation in admin preview routing, letting unauthenticated attackers trick signed-in editors into executing GraphQL operations with their credentials.
- 7.6 /10 HighCVE-2026-108260 Auth required
TinaCMS tina-markdown - Stored XSS
TinaCMS tina-markdown element < 0.2.1 contains a stored XSS caused by unvalidated URL scheme in rich-text node.url assigned to anchor href, letting content authors execute scripts in site origin, exploit requires content author privileges.
- 8.2 /10 HighCVE-2026-108259
Tina @tinacms/cli - Template Injection
Tina @tinacms/cli < 3.0.0 contains a template injection caused by unsafe interpolation of Git branch names into JavaScript string literals, letting attackers execute arbitrary code during preview builds, exploit requires crafted Git branch name.
- 7.5 /10 HighCVE-2026-108160 No auth
AstronRPA - Remote Code Execution
AstronRPA through 1.1.6 contains a code download without integrity check vulnerability caused by lack of signature verification in the auto-update mechanism, letting network attackers execute code as the desktop user by serving malicious updates.
- 7.5 /10 HighCVE-2026-108159 No auth
AstronRPA - Stored XSS & Remote Code Execution
AstronRPA through 1.1.6 contains a stored XSS caused by unsanitized LLM output rendered via v-html in the desktop client's smart-component chat, letting remote attackers execute OS commands, exploit requires crafted web page embedding prompt-injection content.
- 8.1 /10 HighCVE-2026-108157 No auth
Pingvin Share X - Authentication Bypass
Pingvin Share X > 0.19.0 and < 1.22.0 contains an authentication bypass caused by missing email_verified check in GenericOidcProvider during OAuth email linking, letting remote unauthenticated attackers take over accounts including administrators, exploit requires enabled OAuth/OIDC provider and unverified victim email.
- 7.1 /10 HighCVE-2026-108156 No auth
LobsterAI - Path Traversal
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability caused by trusting openclawSourceDir from a skill's _meta.json in the skills:delete IPC handler, letting attackers cause recursive deletion of arbitrary user-writable directories during skill uninstallation, exploit requires user to install a crafted skill.
- 7.1 /10 HighCVE-2026-108125 Auth required
wp-post-author - SQL Injection
wp-post-author < 4.1.0 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-108113 Auth required
ILIAS - Unrestricted File Upload
ILIAS < 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity), letting authenticated authors achieve remote code execution by uploading crafted archives with executable files.
- 9.1 /10 CriticalCVE-2026-108109 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability caused by lack of attempt limits on 6-digit otp_code in customer password reset flow in system/controllers/forgot.php, letting unauthenticated attackers hijack accounts by brute-forcing OTP and reading new password from HTTP response, exploit requires knowing a customer username.
- 7.1 /10 HighCVE-2026-108108 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an authentication bypass caused by Password::chap_verify() returning true for incorrect responses in RADIUS CHAP verification, letting attackers with valid usernames gain network access, exploit requires knowledge of a valid username.