Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 272 of 695

  • 7.3 /10 High
    CVE-2026-105679 Auth required

    Ghost - Stored XSS

    Ghost 6.22.1 to 6.64.0 contains a stored XSS caused by improper content type restriction on uploaded files in the default local storage adapter, letting staff users host scripts that may compromise other admin sessions, exploit requires staff user privileges.

  • 7.2 /10 High
    CVE-2026-105677 Auth required

    Ghost - Remote Code Execution

    Ghost 6.10.3 to 6.64.0 contains a remote code execution caused by improper loading of theme translation files, letting authenticated administrators execute arbitrary code on the server via crafted themes.

  • 7.5 /10 High
    CVE-2026-105675 Auth required

    Ghost - Broken Access Control

    Ghost 4.39.0 to 6.64.0 contains a broken access control caused by staff users with view staff invites permission discovering secret tokens of pending invites, letting staff users escalate privileges by accepting invites, exploit requires staff user permission.

  • 7.3 /10 High
    CVE-2026-105651 Auth required

    Ghost - Stored XSS

    Ghost 5.94.0 to 6.64.0 contains a stored XSS caused by storing non-image files as bookmark icons or thumbnails, letting any staff user host arbitrary HTML on the site's domain, exploit requires staff user privileges.

  • 8.1 /10 High
    CVE-2026-105650 No auth

    Ghost - Stored XSS

    Ghost 2.1.0 to 6.64.0 contains a stored XSS caused by embedding URLs from attacker-controlled websites in post content, letting attackers execute scripts in editor, site, and emails, exploit requires crafted post content.

  • 7.3 /10 High
    CVE-2026-105649 Auth required

    Ghost - Stored XSS

    Ghost 4.22.0 to 6.65.0 contains a stored XSS caused by unsanitized SVG media thumbnails and SVG images uploaded with non-SVG extensions, letting staff users host scripts on the site domain, exploit requires staff user privileges.

  • 7.3 /10 High
    CVE-2026-105643 Auth required

    Ghost - Stored XSS

    Ghost 6.34.0 to 6.67.0 contains a stored cross-site scripting caused by insufficient sanitization of embed cards in the editor, letting any staff user execute scripts in other staff users' admin sessions, exploit requires staff user privileges.

  • 8.8 /10 High
    CVE-2026-105642 No auth

    Ghost - Command Injection

    Ghost 6.56.0 to 6.67.0 contains a command injection caused by vulnerable SVG handling in an image processing library, letting any staff user execute arbitrary commands on the server, exploit requires staff user privileges.

  • 9.8 /10 Critical
    CVE-2026-105641 No auth

    Plane - Authentication Bypass

    Plane prior to 1.4.0 contains a broken authentication caused by fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in deployment manifests, letting attackers forge Django-signed values and bypass live-service authentication, exploit requires unchanged default secrets.

  • 9.1 /10 Critical
    CVE-2026-105640 No auth

    Plane - Authentication Bypass

    Plane prior to 1.4.0 contains an authentication bypass caused by trusting unverified email addresses from Gitea and self-managed GitLab OAuth without ownership verification, letting attackers log in as victims, exploit requires unverified OAuth email.

  • 9.8 /10 Critical
    CVE-2026-105639 No auth

    Plane - Authentication Bypass & Broken Access Control

    Plane < 1.4.0 contains an authentication bypass caused by lack of out-of-band email ownership verification in signup flow, letting unauthenticated attackers register as target users and join workspaces via invitation tokens, exploit requires attacker to register with target email.

  • 9.1 /10 Critical
    CVE-2026-105638 No auth

    Plane - Authentication Bypass

    Plane < 1.4.0 contains an authentication bypass caused by insufficient OTP verification and lack of rate limiting in magic-code email login, letting attackers brute force OTP codes without lockout, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-105637 Auth required

    Plane - Broken Access Control

    Plane prior to 1.4.0 contains a broken access control vulnerability caused by missing project_id constraint in asset retrieval, letting workspace Guests reassign assets to attacker-controlled projects and obtain presigned download URLs, exploit requires guest access in the workspace.

  • 9.9 /10 Critical
    CVE-2026-105636 Auth required

    Plane - Server Side Request Forgery

    Plane < 1.4.0 contains a server-side request forgery caused by lack of redirect target validation in webhook delivery task, letting authenticated users access internal resources via redirects, exploit requires workspace creation privilege.

  • 7.4 /10 High
    CVE-2026-105635

    Plane - Broken Access Control

    Plane < 1.4.0 contains a broken access control caused by ProjectJoinEndpoint allowing unauthenticated access to full ProjectMemberInvite records and insufficient validation on POST, letting attackers accept invitations without original invite, exploit requires knowing invitation UUID.