Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 262 of 695
- 8.8 /10 HighCVE-2026-105797 Auth required
SimpleChat - Command Injection
SimpleChat 0.261.003 and 0.261.027 contain a command injection caused by an authorization ordering flaw in POST /api/user/plugins, letting authenticated low-privileged users execute OS processes under the service identity, exploit requires personal plugins enabled and governance permitting MCP actions.
- 8.8 /10 HighCVE-2026-105796 No auth
Kiota - Code Injection
Kiota 0.5.0 to 1.35.0 contains a code injection vulnerability caused by improper sanitization of documentation comments in Java and PHP generators, letting attackers inject code executed in build or application context, exploit requires generating and compiling/loading malicious source code.
- 9.1 /10 CriticalCVE-2026-105794 No auth
MsQuic - Man-in-the-Middle
MsQuic < 2.4.20, < 2.5.11, and < 2.6.1 contain a man-in-the-middle vulnerability caused by improper server certificate hostname verification in OpenSSL and QuicTLS backends, letting on-path attackers spoof servers, exploit requires network position.
- 9.1 /10 CriticalCVE-2026-105793 Auth required
Microsoft UFO - Command Injection
Microsoft UFO < 3.0.9 contains a command injection caused by unsanitized key_code parameter in press_key tool, letting authenticated Mobile MCP callers execute commands as Android shell user on authorized devices, exploit requires valid API key, adb, and authorized device.
- 7.5 /10 HighCVE-2026-105791 No auth
Microsoft UFO - Command Injection
Microsoft UFO < 3.0.9 contains a command injection caused by improper validation of the bash_command parameter in CommandLineExecutor, letting attackers execute arbitrary code as the desktop user, exploit requires user to run affected agent workflow.
- 8.8 /10 HighCVE-2026-105788 Auth required
Microsoft UFO - Command Injection
Microsoft UFO < 3.0.10 contains a command injection caused by insufficient validation of caller-controlled text and package_name parameters in adb shell commands, letting authenticated users execute arbitrary commands on authorized Android devices, exploit requires valid Mobile MCP API key and authorized device.
- 8.5 /10 HighCVE-2026-105786 No auth
Joplin - Authentication Bypass
Joplin prior to 3.7.13 contains an authentication bypass caused by improper binding of application authorization identifiers, letting attackers obtain victim sessions with full read/write access, exploit requires victim interaction to approve attacker's identifier.
- 8.0 /10 HighCVE-2026-105783 No auth
Joplin Desktop - Broken Access Control
Joplin Desktop < 3.7.13 contains a broken access control vulnerability caused by the Web Clipper server allowing arbitrary origins to access pairing endpoints without origin validation, letting attackers obtain permanent API tokens, exploit requires victim approval of a generic prompt.
- 7.5 /10 HighCVE-2026-105782 No auth
Scrapy - Command Injection
Scrapy 1.4.0 to 2.14.2 contains a command injection caused by unsafe import and execution of Referrer-Policy header values in RefererMiddleware, letting attackers terminate the crawler process remotely, exploit requires processing malicious response.
- 9.9 /10 CriticalCVE-2026-105778 Auth required
Tenda AC5 - Buffer Overflow
Tenda AC5 02.03.01.111_multi contains a stack-based buffer overflow caused by manipulation of the "wifiPwd" argument in /goform/setWifi Wifi Handler, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105776 No auth
bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL - SQL Injection
bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL contains a SQL injection caused by manipulation of the "Username" argument in /admin_transaction.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.7 /10 HighCVE-2026-105764 Auth required
Immich - Remote Code Execution
Immich < 3.2.4 contains a remote code execution caused by improper SVG file handling in thumbnail generation, letting authenticated non-admin users execute code in the server container, exploit requires authenticated non-admin user.
- 9.6 /10 CriticalCVE-2026-105763 Auth required
Twenty - Information Disclosure
Twenty 1.20.10 to 2.7.0 contains an information disclosure caused by unprotected /metadata GraphQL connectedAccounts query exposing plaintext passwords, letting workspace members access other members' external-service credentials, exploit requires membership in the workspace.
- 8.3 /10 HighCVE-2026-105762 No auth
Dify - Server Side Request Forgery
Dify < 1.13.0 contains a server-side request forgery caused by unauthenticated URL input in /console/api/remote-files/upload endpoint, letting remote attackers access internal services or cloud metadata, exploit requires no authentication.
- 7.3 /10 HighCVE-2026-105704 No auth
SourceCodester Drug Recommendation System - Authentication Bypass
SourceCodester Drug Recommendation System 1.0 contains an authentication bypass caused by manipulation of the "user_id" argument in Auth Guard, letting remote attackers bypass authentication, exploit requires crafted request.