Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 293 of 767
- 8.8 /10 HighCVE-2026-107375 Auth required
JHipster - SQL Injection
JHipster 7.0.0 to 9.4.0 contains a SQL injection caused by unvalidated attacker-controlled sort parameters in reactive applications using Spring WebFlux and R2DBC, letting authenticated users read, modify, or delete data.
- 7.1 /10 HighCVE-2026-107362 Auth required
Malcolm file-upload - Information Disclosure
Malcolm file-upload component with pqina/filepond-server-php contains an insecure fetch API route in index.php caused by unrestricted URL download via curl, letting remote attackers read arbitrary remote content, exploit requires network access.
- 7.1 /10 HighCVE-2026-107337 No auth
Malcolm kiosk Flask - Cross Site Request Forgery
Malcolm kiosk Flask application contains a cross site request forgery caused by unauthenticated POST /script_call/<script> endpoint with wildcard CORS, letting attackers force operator's browser to execute arbitrary management commands, exploit requires operator browser interaction.
- 8.1 /10 HighCVE-2026-107333 Auth required
Malcolm nginx - Broken Access Control
Malcolm nginx based reverse proxy contains a broken access control caused by URL path normalization inconsistency between Lua RBAC layer and nginx routing, letting authenticated users bypass role restrictions to access admin endpoints.
- 7.8 /10 HighCVE-2026-107322 No auth
Amazon Agent Plugins databases-on-aws - Command Injection
Amazon Agent Plugins databases-on-aws plugin < 1.7.1 contains a command injection caused by incomplete input validation in database command values, letting remote unauthenticated attackers execute arbitrary OS commands, exploit requires crafted database command.
- 7.4 /10 HighCVE-2026-107318
@fastify/reply-from - Man-in-the-Middle
@fastify/reply-from < 12.7.0 contains a man-in-the-middle vulnerability caused by rejectUnauthorized being set to false in HTTPS transports, letting on-path attackers impersonate upstream servers and intercept data, exploit requires network attacker position.
- 7.6 /10 HighCVE-2026-107303 Auth required
JHipster - Stored XSS
JHipster prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 contains a stored XSS caused by persisting attacker-controlled Blob data and ContentType values, letting authenticated users with write access execute active HTML or SVG under application origin, exploit depends on CSP and browser Blob behavior.
- 7.5 /10 HighCVE-2026-107302 No auth
msgpack5 - Denial of Service
msgpack5 prior to 6.1.0 contains a denial of service caused by improper validation of truncated map32 headers in the decoder, letting attackers cause unexpected termination of requests or streams, exploit requires crafted input.
- 7.5 /10 HighCVE-2026-107300 No auth
msgpack5 - Denial of Service
msgpack5 prior to 6.1.0 contains a denial of service caused by recursive invocation of the streaming decoder on multiple small valid values in a chunk, letting remote attackers exhaust the JavaScript call stack, exploit requires sending crafted chunk with many values.
- 7.6 /10 HighCVE-2026-107295 No auth
Pydantic AI - Broken Access Control
Pydantic AI 1.34.0 to <1.107.4 and 2.28.0 contains a broken access control caused by missing request content-type validation in Agent.to_web() and clai chat endpoint, letting remote attackers execute tools with local process privileges, exploit requires attacker to submit crafted browser-compatible requests to loopback-hosted chat server.
- 7.5 /10 HighCVE-2026-107286 No auth
Pydantic AI - Denial of Service
Pydantic AI 2.10.0 to 2.53.0 contains a denial of service caused by concurrency slot retention in streamed requests via ConcurrencyLimitedModel or limit_model_concurrency, letting attackers block later requests, exploit requires use of shared concurrency limiter with streaming.
- 7.1 /10 HighCVE-2026-106611 No auth
WPMU DEV Forminator - Cross Site Request Forgery
WPMU DEV Forminator <= 1.57.3 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.
- 8.8 /10 HighCVE-2026-106433 Auth required
MongoDB libmongocrypt - Out of Bounds Read/Write
MongoDB libmongocrypt contains an out-of-bounds memory access caused by improper state management when cleaning up key documents with duplicate masterKey fields, letting authenticated actors cause application termination or memory corruption, exploit requires ability to modify key vault documents.
- 9.9 /10 CriticalCVE-2026-106126 Auth required
Tenable Identity Exposure - Command Injection
Tenable Identity Exposure (SaaS) contains a command injection caused by improper input handling in Active Directory Events Listener, letting authenticated low-privileged attackers execute arbitrary commands as SYSTEM on the PDCe, exploit requires authentication.
- 7.7 /10 HighCVE-2026-105833 Auth required
EspoCRM - Broken Access Control
EspoCRM < 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service, letting users with Email Account scope retrieve other users' IMAP passwords, exploit requires knowledge of victim's Email Account record ID.