Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 221 of 695
- 8.7 /10 HighCVE-2026-107378 No auth
CairoSVG - Denial of Service
CairoSVG < 2.9.1 contains a denial of service caused by inefficient path processing in path.py, letting attackers cause high CPU consumption by rendering crafted SVGs, exploit requires attacker to provide malicious SVG input.
- 7.5 /10 HighCVE-2026-107377 No auth
datamodel-code-generator - Path Traversal
datamodel-code-generator 0.59.0 to 0.81.0 contains a path traversal caused by attacker-controlled Protobuf schema paths processed by _write_missing_weak_imports, letting attackers create or overwrite files, exploit requires processing Protobuf schema with grpcio-tools.
- 8.2 /10 HighCVE-2026-107376 No auth
webonyx graphql-php - Denial of Service
webonyx graphql-php < 15.32.3 contains a denial of service caused by lack of recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference, letting remote attackers exhaust PHP process stack, exploit requires crafted deeply nested queries.
- 8.8 /10 HighCVE-2026-107375 Auth required
JHipster - SQL Injection
JHipster 7.0.0 to 9.4.0 contains a SQL injection caused by unvalidated attacker-controlled sort parameters in reactive applications using Spring WebFlux and R2DBC, letting authenticated users read, modify, or delete data.
- 7.1 /10 HighCVE-2026-107362 Auth required
Malcolm file-upload - Information Disclosure
Malcolm file-upload component with pqina/filepond-server-php contains an insecure fetch API route in index.php caused by unrestricted URL download via curl, letting remote attackers read arbitrary remote content, exploit requires network access.
- 7.1 /10 HighCVE-2026-107337 No auth
Malcolm kiosk Flask - Cross Site Request Forgery
Malcolm kiosk Flask application contains a cross site request forgery caused by unauthenticated POST /script_call/<script> endpoint with wildcard CORS, letting attackers force operator's browser to execute arbitrary management commands, exploit requires operator browser interaction.
- 8.1 /10 HighCVE-2026-107333 Auth required
Malcolm nginx - Broken Access Control
Malcolm nginx based reverse proxy contains a broken access control caused by URL path normalization inconsistency between Lua RBAC layer and nginx routing, letting authenticated users bypass role restrictions to access admin endpoints.
- 7.8 /10 HighCVE-2026-107322 No auth
Amazon Agent Plugins databases-on-aws - Command Injection
Amazon Agent Plugins databases-on-aws plugin < 1.7.1 contains a command injection caused by incomplete input validation in database command values, letting remote unauthenticated attackers execute arbitrary OS commands, exploit requires crafted database command.
- 7.4 /10 HighCVE-2026-107318
@fastify/reply-from - Man-in-the-Middle
@fastify/reply-from < 12.7.0 contains a man-in-the-middle vulnerability caused by rejectUnauthorized being set to false in HTTPS transports, letting on-path attackers impersonate upstream servers and intercept data, exploit requires network attacker position.
- 7.6 /10 HighCVE-2026-107303 Auth required
JHipster - Stored XSS
JHipster prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 contains a stored XSS caused by persisting attacker-controlled Blob data and ContentType values, letting authenticated users with write access execute active HTML or SVG under application origin, exploit depends on CSP and browser Blob behavior.
- 7.5 /10 HighCVE-2026-107302 No auth
msgpack5 - Denial of Service
msgpack5 prior to 6.1.0 contains a denial of service caused by improper validation of truncated map32 headers in the decoder, letting attackers cause unexpected termination of requests or streams, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-107300 No auth
msgpack5 - Denial of Service
msgpack5 prior to 6.1.0 contains a denial of service caused by recursive invocation of the streaming decoder on multiple small valid values in a chunk, letting remote attackers exhaust the JavaScript call stack, exploit requires sending crafted chunk with many values.
- 7.6 /10 HighCVE-2026-107295 No auth
Pydantic AI - Broken Access Control
Pydantic AI 1.34.0 to <1.107.4 and 2.28.0 contains a broken access control caused by missing request content-type validation in Agent.to_web() and clai chat endpoint, letting remote attackers execute tools with local process privileges, exploit requires attacker to submit crafted browser-compatible requests to loopback-hosted chat server.
- 7.5 /10 HighCVE-2026-107286 No auth
Pydantic AI - Denial of Service
Pydantic AI 2.10.0 to 2.53.0 contains a denial of service caused by concurrency slot retention in streamed requests via ConcurrencyLimitedModel or limit_model_concurrency, letting attackers block later requests, exploit requires use of shared concurrency limiter with streaming.
- 7.1 /10 HighCVE-2026-106611 No auth
WPMU DEV Forminator - Cross Site Request Forgery
WPMU DEV Forminator <= 1.57.3 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.