Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 261 of 695
- 8.2 /10 HighCVE-2026-105850
Payload @payloadcms/plugin-ecommerce - Broken Authentication
Payload @payloadcms/plugin-ecommerce < 3.90.0 and canary < 4.0.0-canary.34 contains a logic flaw in Stripe payment adapter allowing multiple processing of Stripe order confirmations, letting attackers cause duplicate order processing, exploit requires specific payment conditions.
- 8.3 /10 HighCVE-2026-105849 Auth required
Payload - Broken Access Control
Payload 3.0.0 < 3.90.0 and canary < 4.0.0-canary.34 contain an information disclosure vulnerability caused by improper access control in authentication documents with useAPIKey enabled, letting users with read access obtain active API keys, exploit requires read access to authentication documents.
- 9.6 /10 CriticalCVE-2026-105848 Auth required
Payload @payloadcms/plugin-stripe - Broken Access Control
Payload @payloadcms/plugin-stripe < 3.90.0 and canary < 4.0.0-canary.34 contains a broken access control vulnerability caused by insufficient authorization on the Stripe REST proxy, letting authenticated users perform unintended Stripe operations, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-105845 No auth
Payload - SQL Injection
Payload 3.0.0 < 3.88.0 and canary < 4.0.0-canary.27 contain a SQL injection caused by untrusted user queries through dynamic filters or joins in SQLite and Postgres adapters, letting attackers execute arbitrary SQL commands remotely, exploit requires ability to query readable collections.
- 9.3 /10 CriticalCVE-2026-105844 PoC publicNo auth
Payload CMS - Remote Code Execution
Payload CMS 3.0.0 < 3.88.0 and canary < 4.0.0-canary.27 contains a remote code execution caused by unauthenticated submission of prototype-sensitive field paths in @payloadcms/plugin-import-export, letting unauthenticated attackers execute code remotely, exploit requires the import-export plugin enabled.
- 7.5 /10 HighCVE-2026-105841 No auth
lrzsz - Command Injection
lrzsz before 0.13.0 contains a command injection vulnerability caused by unescaped filenames passed to popen() in the lrz receive utility's pipe mode, letting remote senders execute OS commands, exploit requires crafted filenames.
- 7.5 /10 HighCVE-2026-105840 No auth
lrzsz - Path Traversal
lrzsz before 0.13.0 contains a path traversal vulnerability caused by insufficient path validation in the lrz receive utility's restricted mode, letting malicious ZMODEM senders write files outside the current directory using absolute pathnames, exploit requires attacker to send crafted files.
- 7.8 /10 HighCVE-2026-105839 No auth
libmikmod - Integer Overflow
libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() caused by crafted track counts in SLEN chunk, letting attackers cause heap buffer overflow for crashes or code execution, exploit requires crafted OKT module.
- 7.8 /10 HighCVE-2026-105837 No auth
libmikmod - Integer Overflow
libmikmod before 3.3.14 contains an integer overflow vulnerability caused by product wrap of numchn and numpat in DSM_Load() in load_dsm.c, letting attackers trigger heap buffer overflow and potential code execution, exploit requires crafted DSM module.
- 7.4 /10 HighCVE-2026-105835 No auth
Planka - Authentication Bypass
Planka 2.2.0 through 2.2.1 contains a broken authentication caused by failure to limit incorrect TOTP codes on POST /api/access-tokens/verify-totp, letting attackers brute force two-factor authentication codes, exploit requires attacker to know user password and reuse pending token.
- 9.0 /10 CriticalCVE-2026-105812 Auth required
Amazon Bedrock AgentCore Starter Toolkit - Remote Code Execution
Amazon Bedrock AgentCore Starter Toolkit < 0.3.14 contains a remote code execution caused by improper control of code generation in agent import functionality, letting authenticated same-account actors execute arbitrary code via crafted configuration values, exploit requires authentication.
- 7.3 /10 HighCVE-2026-105807 No auth
SourceCodester Simple Student Information System - SQL Injection
SourceCodester Simple Student Information System 1.0 contains a sql injection caused by manipulation in searchquery.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 8.6 /10 HighCVE-2026-105806 Auth required
Payload @payloadcms/plugin-mcp - Broken Access Control
Payload @payloadcms/plugin-mcp 3.61.0 to 3.88.0 contains a broken access control vulnerability caused by improper management of MCP API keys, letting authenticated users escalate privileges via account takeover, exploit requires authentication.
- 8.4 /10 HighCVE-2026-105801 No auth
openapi-python-client - Code Injection
openapi-python-client < 0.29.1 contains a code injection caused by unsafe neutralization of malicious OpenAPI document content in string, docstring, and f-string contexts, letting attackers execute arbitrary Python code on import, exploit requires importing the generated client.
- 8.7 /10 HighCVE-2026-105798 Auth required
SimpleChat - Stored XSS
SimpleChat < 0.261.029 contains a stored XSS caused by improper escaping of attacker-controlled group document filenames in group_workspaces.html, letting authenticated group Owner, Admin, or DocumentManager execute scripts in victim sessions when Share is clicked.