Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 260 of 695
- 7.1 /10 HighCVE-2026-105868 No auth
Payload - Stored XSS
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a stored XSS caused by local upload configurations accepting XML files with stylesheets, letting logged-in users execute JavaScript in the Payload origin, exploit requires user to be logged in.
- 7.5 /10 HighCVE-2026-105866 No auth
Payload - Authentication Bypass
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain an account lockout abuse vulnerability caused by improper handling of local-authentication collections, letting unauthenticated attackers prevent account sign-in by triggering lockout, exploit requires knowledge of account email or username.
- 8.1 /10 HighCVE-2026-105865 Auth required
Payload - Broken Access Control
Payload before 3.90.0 and canary before 4.0.0-canary.34 contains a file cleanup vulnerability caused by improper restriction on file deletion outside the upload directory, letting authenticated users cause data loss or service disruption, exploit requires upload update or delete permissions.
- 9.4 /10 CriticalCVE-2026-105863 No auth
Payload CMS - Authentication Bypass
Payload CMS > 3.0.0 and < 3.90.0 contains a broken authentication caused by mapping a custom field to a reserved authentication claim name, letting attackers place unintended values in issued authentication tokens, exploit requires login.
- 8.7 /10 HighCVE-2026-105862 Auth required
Payload - Stored XSS
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain a stored XSS caused by insufficient sanitization of downloadable SVG uploads in collections, letting attackers execute JavaScript when users open the SVG, exploit requires user to download and open the SVG.
- 8.2 /10 HighCVE-2026-105861 No auth
Payload - Open Redirect
Payload >3.0.0 and <3.90.0 contains an open redirect caused by unverified external URL-based upload retrieval forwarding authentication data, letting authenticated attackers expose valid sessions to unintended recipients, exploit requires authentication.
- 7.1 /10 HighCVE-2026-105860 Auth required
Payload @payloadcms/plugin-multi-tenant - Broken Access Control
Payload @payloadcms/plugin-multi-tenant < 3.90.0 and < 4.0.0-canary.34 contains a broken access control caused by default tenant array field access allowing authenticated users to assign their account to other tenants, letting authenticated users escalate privileges, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-105859 No auth
Payload - Broken Access Control
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a broken access control vulnerability caused by lack of enforcement on collection or field-level access control when orderable is enabled, letting attackers modify collection documents remotely, exploit requires orderable enabled on collection or join field.
- 8.1 /10 HighCVE-2026-105858
Payload - Remote Code Execution
Payload < 3.90.0 and canary < 4.0.0-canary.34 contains a remote code execution caused by crafted requests to the public first-register operation when local authentication is enabled and no initial user exists, letting attackers execute code remotely.
- 10.0 /10 CriticalCVE-2026-105857 No auth
Payload @payloadcms/plugin-form-builder - Remote Code Execution
Payload @payloadcms/plugin-form-builder < 3.90.0 and < 4.0.0-canary.34 contains a remote code execution caused by crafted form submissions, letting attackers execute code remotely on the server, exploit requires crafted form submission.
- 8.3 /10 HighCVE-2026-105856 Auth required
Payload - SQL Injection
Payload before 3.90.0 and 4.0.0-canary.34 contains a SQL injection caused by crafted field path and operators in JSON or blocks fields with blocksAsJSON enabled, letting attackers with read and create or update access inject SQL.
- 7.1 /10 HighCVE-2026-105855 Auth required
Payload - Broken Access Control
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a broken access control caused by failure to enforce field-level update restrictions on the password field in the authentication collection, letting attackers modify passwords without proper authorization.
- 7.5 /10 HighCVE-2026-105854 No auth
Payload - Denial of Service
Payload 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 contain a denial of service caused by malformed multipart request body processing, letting attackers cause uncontrolled resource consumption, exploit requires sending crafted multipart requests.
- 7.5 /10 HighCVE-2026-105852 No auth
Payload - Broken Access Control
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain an information disclosure caused by querying readable collections with relationships exposing protected related documents, letting attackers access unauthorized data, exploit requires querying specific collections.
- 8.1 /10 HighCVE-2026-105851 Auth required
Payload - Access Control Bypass
Payload 3.0.0 to < 3.90.0 and canary < 4.0.0-canary.34 contains an access control bypass caused by duplicate operation copying values despite hidden fields or access rules, letting attackers bypass access restrictions, exploit requires crafted duplicate operation.