Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 190 of 681
- 9.8 /10 CriticalCVE-2026-108107 No auth
PHPNuxBill - SQL Injection
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection caused by interpolation of request parameters in radius.php FreeRADIUS REST endpoint, letting attackers extract customer records and credentials via time-based blind SQL injection, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-108106 No auth
Xerial snappy-java - Denial of Service
Xerial snappy-java < 1.1.10.9 contains an unbounded memory allocation vulnerability caused by large uncompressed length in compressed input, letting attackers exhaust JVM memory causing denial of service, exploit requires crafted compressed input.
- 7.5 /10 HighCVE-2026-108101 Auth required
HortusFox hortusfox-web - Unrestricted File Upload
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel, letting authenticated users upload malicious files for stored cross-site scripting or remote code execution, exploit requires user authentication.
- 9.3 /10 CriticalCVE-2026-107935 No auth
gvisor-tap-vsock gvproxy - Path Traversal
gvisor-tap-vsock gvproxy contains a path traversal caused by improper validation of socket path in /services/forwarder/expose endpoint, letting unauthenticated attackers delete arbitrary files on the host system, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-107914 No auth
Backdrop CMS - Broken Access Control
Backdrop CMS 1.34 < 1.34.5 and 1.35 < 1.35.1 contain an information disclosure vulnerability caused by insufficient protection of configuration exports in compressed archives, letting attackers with specific permissions access sensitive configuration data, exploit requires prior export request with proper permissions.
- 7.5 /10 HighCVE-2026-107911 Auth required
FalkorDB - Denial of Service & Memory Corruption
FalkorDB < 4.20.0 contains a type confusion vulnerability caused by improper casting of Redis string objects to Bolt client structures in _read_flags function, letting remote authenticated attackers cause denial of service or memory corruption via GRAPH.QUERY, exploit requires authentication.
- 8.1 /10 HighCVE-2026-107910 No auth
FalkorDB - Authentication Bypass
FalkorDB < 4.20.0 contains an improper authentication vulnerability caused by incorrect handling of Redis AUTH command errors in is_authenticated function, letting remote unauthenticated attackers execute graph queries via the Bolt endpoint, exploit requires Bolt endpoint enabled.
- 9.1 /10 CriticalCVE-2026-107909 No auth
FalkorDB - Denial of Service
FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper bounds checking in ws_read_frame and buffer_apply_mask functions, letting remote unauthenticated attackers cause denial of service and heap corruption by sending crafted WebSocket frames, exploit requires Bolt endpoint enabled.
- 9.8 /10 CriticalCVE-2026-107908 No auth
FalkorDB - Out of Bounds Read/Write
FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper size validation in BoltReadHandler, letting remote unauthenticated attackers cause denial of service or execute arbitrary code via crafted Bolt RESET messages, exploit requires Bolt endpoint enabled.
- 7.1 /10 HighCVE-2026-107852 Auth required
Jexactyl - Broken Access Control
Jexactyl < 4.0.5 contains a broken access control vulnerability caused by improper validation of Stripe Checkout Session amount and currency in /api/client/billing/stripe/process, letting authenticated clients pay less or in mismatched currency to process orders.
- 9.3 /10 CriticalCVE-2026-107845 No auth
Contao - Stored XSS
Contao 4.0.0 to 5.3.50 and 5.7.12 contains a stored XSS caused by insufficient attribute and URL encoding in listComments() in comments-bundle/contao/dca/tl_comments.php, letting unauthenticated visitors execute scripts in backend user sessions, exploit requires backend user to open Comments module.
- 7.5 /10 HighCVE-2026-107840 No auth
Yopass - Denial of Service
Yopass < 14.7.0 contains a denial of service caused by unvalidated use of attacker-controlled HTTP method tokens in Prometheus metrics middleware, letting unauthenticated remote attackers cause memory exhaustion, exploit requires sending arbitrary HTTP methods.
- 7.5 /10 HighCVE-2026-107839 No auth
ageLANServer - Denial of Service
ageLANServer < 1.15.2 contains a denial of service caused by lack of request body size limit in AoE3 POST /game/cloud/getFileURL handler, letting remote unauthenticated clients crash or hang the server, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-107838
RIOT - Denial of Service
RIOT 2023.07 through 2026.07 contains a denial of service caused by ignoring failure from _resp_init() when coap_build_reply() cannot fit a response header, letting remote clients with large extended tokens terminate service, exploit requires nanocoap_token_ext enabled.
- 8.2 /10 HighCVE-2026-107837 No auth
RIOT - Out of Bounds Read
RIOT <= 2026.07 contains an out-of-bounds read caused by insufficient payload validation in _receive() leading to improper sixlowpan_frag_t handling, letting remote attackers cause memory disclosure and network stack crash, exploit requires sending malformed 6LoWPAN fragments.