Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 24 of 677
- 7.4 /10 HighCVE-2026-57492 No auth
FileRise - Authentication Bypass
FileRise < 3.16.0 contains an authentication bypass caused by treating an empty or missing users.txt file as a fresh installation, letting unauthenticated remote attackers create an administrator account, exploit requires user store to be empty or missing.
- 8.1 /10 HighCVE-2026-57490 Auth required
FileRise - Authentication Bypass
FileRise < 3.16.0 contains a broken authentication caused by WebDAV Basic authentication bypassing TOTP enforcement, letting attackers with valid primary credentials access WebDAV without second factor, exploit requires valid primary credentials for TOTP-enabled account.
- 8.1 /10 HighCVE-2026-57489 No auth
FileRise - Authentication Bypass
FileRise < 3.16.0 contains an authentication bypass caused by trusting reverse-proxy identity headers without verifying request origin, letting unauthenticated attackers obtain sessions for arbitrary accounts including admin, exploit requires proxy-header authentication enabled and backend port exposure.
- 7.1 /10 HighCVE-2026-55787 Auth required
Flyto2 Core - Server Side Request Forgery
Flyto2 Core < 2.26.3 contains a server-side request forgery caused by improper validation of transition-form IP addresses in URL checks, letting authenticated workflow authors read internal services and cloud metadata via crafted URLs.
- 8.4 /10 HighCVE-2026-55786 CISA KEVNo auth
Flyto2 Core - Remote Code Execution
Flyto2 Core 2.26.2 to 2.26.4 contains a remote code execution caused by unauthenticated JSON-RPC requests forwarding execute_module arguments without authentication, letting unauthenticated attackers execute arbitrary OS commands, exploit requires network or local access to the MCP POST /mcp route.
- 9.8 /10 CriticalCVE-2026-55684 No auth
WeGIA - SQL Injection
WeGIA < 3.8.6 contains a SQL injection caused by unsanitized interpolation of POST parameters in cadastro_cobrancas_geracao.php, letting remote attackers execute arbitrary SQL to read or modify sensitive data, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-55683 No auth
WeGIA - SQL Injection
WeGIA < 3.8.6 contains a SQL injection caused by unsanitized POST parameters in web/html/socio/sistema/cadastro_cobranca.php, letting remote attackers read, modify, or delete database content, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-55682 No auth
WeGIA - Authentication Bypass
WeGIA < 3.8.6 contains a session fixation vulnerability caused by reflection of attacker-supplied PHPSESSID cookie and use of DB_HOST as cookie domain, letting attackers hijack authenticated sessions and disclose internal DB host, exploit requires victim authentication with attacker-chosen session ID.
- 8.8 /10 HighCVE-2026-55681 Auth required
WeGIA - SQL Injection
WeGIA < 3.8.6 contains a SQL injection caused by a second extract($_REQUEST) overwriting sanitized id_produto in web/html/matPat/restaurar_produto_desocultar.php, letting authenticated users execute arbitrary SQL to extract or modify data.
- 9.8 /10 CriticalCVE-2026-55680 No auth
WeGIA - SQL Injection
WeGIA < 3.8.6 contains a SQL injection caused by unsanitized 'codigo' parameter in web/html/socio/sistema/cadastro_cobranca.php, letting unauthenticated attackers read or modify database content, exploit requires crafted POST request.
- 9.8 /10 CriticalCVE-2026-55573 No auth
e107 - Remote Code Execution
e107 < 2.3.7 contains an insecure deserialization caused by unserialize() of attacker-controlled previous_steps POST parameter in install.php, letting unauthenticated attackers execute arbitrary PHP functions with web server privileges, exploit requires access to install.php.
- 10.0 /10 CriticalCVE-2026-55572 No auth
e107 - SQL Injection
e107 < 2.3.7 contains a SQL injection caused by unsanitized username interpolation in alt_auth plugin's otherdb and e107db authentication backends, letting unauthenticated attackers expose or modify database data, exploit requires alt_auth with live external DB connection.
- 7.2 /10 HighCVE-2026-55387 Auth required
InvoiceShelf - Broken Access Control
InvoiceShelf <= 2.3.3 contains a broken access control vulnerability caused by insufficient validation of record identifiers in bulk-delete requests, letting authenticated users delete records from other companies, exploit requires authentication.
- 7.1 /10 HighCVE-2026-55386 Auth required
InvoiceShelf - SQL Injection
InvoiceShelf < 2.4.0 contains a SQL injection caused by unsanitized orderByField parameter in Laravel orderBy calls in Invoice::scopeApplyFilters, letting authenticated attackers perform boolean-based blind SQL injection, exploit requires authentication.
- 8.2 /10 HighCVE-2026-55383 No auth
InvoiceShelf - Broken Access Control
InvoiceShelf < 2.4.0 contains an information disclosure caused by improper verification of EmailLog token's mailable_type and expiration in public customer invoice, estimate, and payment routes, letting attackers access other companies' documents and use expired tokens, exploit requires crafted token with numeric identifier collision.