Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 276 of 695
- 8.7 /10 HighCVE-2026-104976 Auth required
Plane - Server Side Request Forgery
Plane prior to 1.4.0 contains a server-side request forgery caused by insufficient validation of GITEA_HOST and avatar_url in the Gitea OAuth flow, letting authenticated Gitea users make internal network requests, exploit requires Gitea OAuth enabled and user login.
- 7.1 /10 HighCVE-2026-104975 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by missing membership check and project_id constraint in Spaces app asset endpoints, letting attackers read, overwrite, or restore assets across projects and workspaces, exploit requires no special privileges.
- 8.1 /10 HighCVE-2026-104974 Auth required
Plane - Authentication Bypass
Plane < 1.4.0 contains an authentication bypass caused by reactivation of deactivated accounts upon login, letting users with deactivated accounts silently reactivate themselves, exploit requires valid user credentials.
- 7.6 /10 HighCVE-2026-104973
Plane - Server Side Request Forgery
Plane < 1.4.0 contains a server side request forgery caused by improper IP validation in webhook delivery task allowing DNS rebinding to bypass SSRF protection, letting attackers perform SSRF via DNS rebinding, exploit requires DNS rebinding capability.
- 8.5 /10 HighCVE-2026-104971 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains broken access control caused by missing workspace authorization checks in DuplicateAssetEndpoint, WorkspaceFileAssetEndpoint, FileAssetEndpoint, and WorkspaceViewViewSet.retrieve, letting authenticated users access and modify assets across workspaces without membership, exploit requires authentication.
- 8.1 /10 HighCVE-2026-104970 No auth
Plane - Broken Access Control
Plane 0.13 to 1.4.0 contains a broken access control caused by lack of atomic transaction and locking in InstanceAdminSignUpEndpoint, letting unauthenticated attackers create multiple instance-admin accounts concurrently.
- 8.7 /10 HighCVE-2026-104968 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains an information disclosure vulnerability caused by lack of workspace-membership checks in GET /api/workspaces/{slug}/entity-search/, letting authenticated users access workspace member details without membership, exploit requires authentication and knowledge of workspace slug.
- 8.7 /10 HighCVE-2026-104966 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control caused by improper verification of nested resource identifiers in workspace and project endpoints, letting authenticated users read or modify estimates and inject comments across workspaces, exploit requires authentication.
- 8.1 /10 HighCVE-2026-104905 PoC publicAuth required
FacturaScripts - Insecure Deserialization
FacturaScripts before version 2026.7 contains a PHP object injection caused by unsafe unserialize() usage in WidgetSelect::processFormData(), letting authenticated attackers delete arbitrary files via serialized XLSXWriter objects, exploit requires authentication.
- 8.7 /10 HighCVE-2026-104892 Auth required
Plane - Authentication Bypass
Plane < 1.4.0 contains a broken authentication vulnerability caused by aPITokenLogMiddleware logging API keys in plaintext, letting low-privilege attackers steal API keys and escalate privileges, exploit requires low privilege access.
- 7.5 /10 HighCVE-2026-104891 No auth
@insumermodel mppx-condition-gate - Authentication Bypass
@insumermodel mppx-condition-gate < 3.0.0 and mppx-token-gate < 1.0.4 contain an authentication bypass caused by accepting client-supplied wallet addresses without verifying control, letting unauthenticated attackers gain unauthorized free access, exploit requires attacker to specify a qualifying wallet address.
- 7.2 /10 HighCVE-2026-104890 Auth required
Kunstmaan CMS - Remote Code Execution
Kunstmaan CMS < 7.3.2 contains a remote code execution vulnerability caused by case-sensitive blacklisted extension checks in FileHandler, letting authenticated backend users upload executable files bypassing restrictions.
- 8.2 /10 HighCVE-2026-104852 No auth
GraphQL Tools - Prototype Pollution
GraphQL Tools utils package < 12.0.1 contains a prototype pollution caused by mergeDeep function merging inherited properties including __proto__, constructor, and prototype keys, letting unauthenticated GraphQL clients cause denial of service by breaking subsequent requests, exploit requires unauthenticated client to alias fields.
- 8.4 /10 HighCVE-2026-104811 Auth required
DigitalCanion SA - Remote Code Execution
DigitalCanion SA product contains a remote code execution vulnerability caused by improper validation of uploaded file types in Configuration → Services → Music on Hold, letting authenticated attackers execute arbitrary code via malicious .so files.
- 8.4 /10 HighCVE-2026-104810 Auth required
Mitel MiVoice Office 400 - Path Traversal
Mitel MiVoice Office 400 contains a path traversal vulnerability in the web portal's File Browser under Maintenance → File Management, letting authenticated attackers delete sensitive files outside intended directories, causing denial of service.