Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 274 of 695
- 7.3 /10 HighCVE-2026-105383 No auth
onetwothreeneth HospitalManagementSystem - SQL Injection
onetwothreeneth HospitalManagementSystem contains a SQL injection caused by manipulation of the "transaction_idS" argument in php/controller.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105382 No auth
onetwothreeneth HospitalManagementSystem - Broken Access Control
onetwothreeneth HospitalManagementSystem contains a broken access control caused by improper authorization in update_subaccount function of Account Administration, letting remote attackers manipulate user_id to escalate privileges, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-105314 PoC publicAuth required
Papermerge - Remote Code Execution
Papermerge 3.5.3 contains a remote code execution caused by directory traversal in /api/documents/upload, letting standard users write Python .pth files to site-packages and execute code on interpreter restart, exploit requires standard user privileges.
- 7.3 /10 HighCVE-2026-105307 No auth
Casdoor - Authentication Bypass
Casdoor <= 3.161.1 contains an authentication bypass caused by manipulation in ApiFilter function in routers/authz_filter.go API Endpoint, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-105295
GitAhead - Remote Code Execution
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism caused by lack of integrity and signature verification and ignoring TLS errors, letting network attackers execute code as the user via fake updates, exploit requires attacker to intercept update checks.
- 7.4 /10 HighCVE-2026-105294 No auth
Legcord - Configuration Injection
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability caused by improper validation in window.legcord settings.setConfig bridge, letting attackers exploiting Discord XSS persistently modify client config, exploit requires Discord XSS.
- 8.1 /10 HighCVE-2026-105293 No auth
Legcord - Path Traversal
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability caused by unvalidated theme IDs in theme IPC handlers, letting attackers running script in Discord origin execute local files and modify directories, exploit requires script execution in Discord origin.
- 7.3 /10 HighCVE-2026-105290 No auth
feelec-yishu feelcrm-os - Server-Side Request Forgery
feelec-yishu feelcrm-os 1.0.0 contains a server-side request forgery caused by manipulation of the "url" argument in getCurlData Endpoint of GoogleController.class.php, letting remote attackers make arbitrary requests, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-105285 No auth
Totolink A3002MU - Buffer Overflow
Totolink A3002MU 1.0.0-B20230403.1455 contains a stack-based buffer overflow caused by manipulation of the addQos/comment/entry_name argument in /boafrm/formIpQoS QoS Rule Handler, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-105284 No auth
Totolink A3002MU - Authentication Bypass
Totolink A3002MU 1.0.0-B20230403.1455 contains an improper authorization vulnerability caused by manipulation in the Authentication Check function sub_40FCFC in /bin/boa, letting remote attackers bypass authorization, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105253 No auth
itsourcecode Online Admission System Project - SQL Injection
itsourcecode Online Admission System Project 1.0 contains a sql injection caused by manipulation of the "User" argument in /admin/login1.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105247 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Subject" argument in /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105246 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "Subject" argument in /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105238 No auth
ChatGPTNextWeb NextChat - Server-Side Request Forgery
ChatGPTNextWeb NextChat <= 2.16.1 contains a server-side request forgery caused by manipulation of the "x-base-url" argument in app/api/proxy.ts Proxy Fallback Handler, letting remote attackers initiate SSRF, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105232 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of username/email/location arguments in delivery/deliverysignup.php Registration Page, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.