Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 204 of 695
- 9.9 /10 CriticalCVE-2026-108263 Auth required
Astron Agent - Remote Code Execution
Astron Agent < 1.1.2 contains a remote code execution caused by default use of LocalExecutor without sandbox restrictions in dynamic code execution, letting authenticated low-privilege tenants execute code as root and bypass tenant checks.
- 9.3 /10 CriticalCVE-2026-108261 No auth
TinaCMS - Broken Access Control
TinaCMS < 3.14.0 and @tinacms/app < 2.5.14 contain a broken access control vulnerability caused by improper origin validation in admin preview routing, letting unauthenticated attackers trick signed-in editors into executing GraphQL operations with their credentials.
- 7.6 /10 HighCVE-2026-108260 Auth required
TinaCMS tina-markdown - Stored XSS
TinaCMS tina-markdown element < 0.2.1 contains a stored XSS caused by unvalidated URL scheme in rich-text node.url assigned to anchor href, letting content authors execute scripts in site origin, exploit requires content author privileges.
- 8.2 /10 HighCVE-2026-108259
Tina @tinacms/cli - Template Injection
Tina @tinacms/cli < 3.0.0 contains a template injection caused by unsafe interpolation of Git branch names into JavaScript string literals, letting attackers execute arbitrary code during preview builds, exploit requires crafted Git branch name.
- 7.5 /10 HighCVE-2026-108160 No auth
AstronRPA - Remote Code Execution
AstronRPA through 1.1.6 contains a code download without integrity check vulnerability caused by lack of signature verification in the auto-update mechanism, letting network attackers execute code as the desktop user by serving malicious updates.
- 7.5 /10 HighCVE-2026-108159 No auth
AstronRPA - Stored XSS & Remote Code Execution
AstronRPA through 1.1.6 contains a stored XSS caused by unsanitized LLM output rendered via v-html in the desktop client's smart-component chat, letting remote attackers execute OS commands, exploit requires crafted web page embedding prompt-injection content.
- 8.1 /10 HighCVE-2026-108157 No auth
Pingvin Share X - Authentication Bypass
Pingvin Share X > 0.19.0 and < 1.22.0 contains an authentication bypass caused by missing email_verified check in GenericOidcProvider during OAuth email linking, letting remote unauthenticated attackers take over accounts including administrators, exploit requires enabled OAuth/OIDC provider and unverified victim email.
- 7.1 /10 HighCVE-2026-108156 No auth
LobsterAI - Path Traversal
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability caused by trusting openclawSourceDir from a skill's _meta.json in the skills:delete IPC handler, letting attackers cause recursive deletion of arbitrary user-writable directories during skill uninstallation, exploit requires user to install a crafted skill.
- 7.1 /10 HighCVE-2026-108125 Auth required
wp-post-author - SQL Injection
wp-post-author < 4.1.0 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-108113 Auth required
ILIAS - Unrestricted File Upload
ILIAS < 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity), letting authenticated authors achieve remote code execution by uploading crafted archives with executable files.
- 9.1 /10 CriticalCVE-2026-108109 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability caused by lack of attempt limits on 6-digit otp_code in customer password reset flow in system/controllers/forgot.php, letting unauthenticated attackers hijack accounts by brute-forcing OTP and reading new password from HTTP response, exploit requires knowing a customer username.
- 7.1 /10 HighCVE-2026-108108 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an authentication bypass caused by Password::chap_verify() returning true for incorrect responses in RADIUS CHAP verification, letting attackers with valid usernames gain network access, exploit requires knowledge of a valid username.
- 9.8 /10 CriticalCVE-2026-108107 No auth
PHPNuxBill - SQL Injection
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection caused by interpolation of request parameters in radius.php FreeRADIUS REST endpoint, letting attackers extract customer records and credentials via time-based blind SQL injection, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-108106 No auth
Xerial snappy-java - Denial of Service
Xerial snappy-java < 1.1.10.9 contains an unbounded memory allocation vulnerability caused by large uncompressed length in compressed input, letting attackers exhaust JVM memory causing denial of service, exploit requires crafted compressed input.
- 7.5 /10 HighCVE-2026-108101 Auth required
HortusFox hortusfox-web - Unrestricted File Upload
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel, letting authenticated users upload malicious files for stored cross-site scripting or remote code execution, exploit requires user authentication.