Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 267 of 695

  • 7.7 /10 High
    CVE-2026-101027 Auth required

    Gitea - Server Side Request Forgery

    Gitea contains a server-side request forgery caused by insufficient validation of resolved addresses for allowed hostnames in migrations, letting attackers bypass local network restrictions and access internal services, exploit requires control over DNS of allowed hostname.

  • 9.1 /10 Critical
    CVE-2026-101023 No auth

    Gitea - Authentication Bypass

    Gitea contains an OAuth2 token endpoint vulnerability caused by improper validation of token type in refresh_token grant, letting attackers with access tokens extend access beyond original lifetime, exploit requires valid access token.

  • 9.8 /10 Critical
    CVE-2025-71383 No auth

    Dbit WIFI4 N300 - Denial of Service

    Dbit WIFI4 N300 1.0.0 contains a denial of service caused by an error in JSON parser when a request from local Wi-Fi network lacks /api/login username or password field, letting local attackers crash the management interface.

  • 8.1 /10 High
    CVE-2025-45871 Auth required

    LogicalDOC Enterprise - SQL Injection

    LogicalDOC Enterprise <= 9.1.1 contains a blind SQL injection caused by manipulation of workflow template name in WorkflowsDataServlet, letting authenticated users manipulate SQL queries.

  • 7.1 /10 High
    CVE-2026-97309 Auth required

    Webful Creations RepairBuddy - Broken Access Control

    Webful Creations RepairBuddy <= 4.1226 contains a broken access control vulnerability caused by missing authorization checks, letting attackers retrieve embedded sensitive data, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-97303 Auth required

    Apps Mav Scratch & Win – Giveaways and Contests - Broken Access Control

    Apps Mav Scratch & Win – Giveaways and Contests <= 3.0.2 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-97283 No auth

    Liquid Web / StellarWP Advanced Post Manager - Insecure Deserialization

    Liquid Web / StellarWP Advanced Post Manager <= 4.5.5 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-97257 Auth required

    PressTigers Simple Event Planner - Insecure Deserialization

    PressTigers Simple Event Planner <= 1.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-95265 No auth

    Feehi CMS - Server Side Request Forgery

    Feehi CMS 2.1.1 contains a server side request forgery caused by insufficient private-IP validation in the UEditor catchimage endpoint, letting attackers probe internal HTTP services, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-95263 Auth required

    Feehi CMS - Broken Access Control

    Feehi CMS 2.1.1 contains an incorrect access control vulnerability caused by lack of protection on the built-in super administrator account, letting low-privilege backend administrators change its password without the old password.

  • 8.2 /10 High
    CVE-2026-94201 No auth

    Ash - Denial of Service

    Ash 3.5.1 to < 3.34.3 contains a denial of service caused by unsafe atom interning in :atom-typed attributes with unsafe_to_atom?: true, letting attackers exhaust the atom table and crash the node, exploit requires attacker-controlled filter values.

  • 7.2 /10 High
    CVE-2026-93617 Auth required

    Sunshine Photo Cart - Insecure Deserialization

    Sunshine Photo Cart <= 3.7.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-93318

    BuildKit - Code Injection

    BuildKit contains a code injection vulnerability caused by trusting advertised DiffIDs without validating actual layer contents, letting attackers run malicious code in victim builds, exploit requires shared or persistent cache usage.

  • 7.1 /10 High
    CVE-2026-93316

    BuildKit - Denial of Service

    BuildKit daemon contains a denial of service caused by panic when builds use CDI devices while started with --cdi-disabled, letting attackers or accidental triggers crash the daemon, exploit requires daemon started with --cdi-disabled.

  • 8.8 /10 High
    CVE-2026-92931 No auth

    Progress @progress/sitefinity-nextjs-sdk - Server-Side Request Forgery

    Progress @progress/sitefinity-nextjs-sdk 15.1.8326 through 15.4.8637 contains a server-side request forgery caused by improper validation of URLs, letting remote attackers make server-side requests to attacker-controlled hosts, exploit requires network access.