Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 332 of 767
- 9.4 /10 CriticalCVE-2026-105863 No auth
Payload CMS - Authentication Bypass
Payload CMS > 3.0.0 and < 3.90.0 contains a broken authentication caused by mapping a custom field to a reserved authentication claim name, letting attackers place unintended values in issued authentication tokens, exploit requires login.
- 8.7 /10 HighCVE-2026-105862 Auth required
Payload - Stored XSS
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain a stored XSS caused by insufficient sanitization of downloadable SVG uploads in collections, letting attackers execute JavaScript when users open the SVG, exploit requires user to download and open the SVG.
- 8.2 /10 HighCVE-2026-105861 No auth
Payload - Open Redirect
Payload >3.0.0 and <3.90.0 contains an open redirect caused by unverified external URL-based upload retrieval forwarding authentication data, letting authenticated attackers expose valid sessions to unintended recipients, exploit requires authentication.
- 7.1 /10 HighCVE-2026-105860 Auth required
Payload @payloadcms/plugin-multi-tenant - Broken Access Control
Payload @payloadcms/plugin-multi-tenant < 3.90.0 and < 4.0.0-canary.34 contains a broken access control caused by default tenant array field access allowing authenticated users to assign their account to other tenants, letting authenticated users escalate privileges, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-105859 No auth
Payload - Broken Access Control
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a broken access control vulnerability caused by lack of enforcement on collection or field-level access control when orderable is enabled, letting attackers modify collection documents remotely, exploit requires orderable enabled on collection or join field.
- 8.1 /10 HighCVE-2026-105858
Payload - Remote Code Execution
Payload < 3.90.0 and canary < 4.0.0-canary.34 contains a remote code execution caused by crafted requests to the public first-register operation when local authentication is enabled and no initial user exists, letting attackers execute code remotely.
- 10.0 /10 CriticalCVE-2026-105857 No auth
Payload @payloadcms/plugin-form-builder - Remote Code Execution
Payload @payloadcms/plugin-form-builder < 3.90.0 and < 4.0.0-canary.34 contains a remote code execution caused by crafted form submissions, letting attackers execute code remotely on the server, exploit requires crafted form submission.
- 8.3 /10 HighCVE-2026-105856 Auth required
Payload - SQL Injection
Payload before 3.90.0 and 4.0.0-canary.34 contains a SQL injection caused by crafted field path and operators in JSON or blocks fields with blocksAsJSON enabled, letting attackers with read and create or update access inject SQL.
- 7.1 /10 HighCVE-2026-105855 Auth required
Payload - Broken Access Control
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a broken access control caused by failure to enforce field-level update restrictions on the password field in the authentication collection, letting attackers modify passwords without proper authorization.
- 7.5 /10 HighCVE-2026-105854 No auth
Payload - Denial of Service
Payload 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 contain a denial of service caused by malformed multipart request body processing, letting attackers cause uncontrolled resource consumption, exploit requires sending crafted multipart requests.
- 7.5 /10 HighCVE-2026-105852 No auth
Payload - Broken Access Control
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain an information disclosure caused by querying readable collections with relationships exposing protected related documents, letting attackers access unauthorized data, exploit requires querying specific collections.
- 8.1 /10 HighCVE-2026-105851 Auth required
Payload - Access Control Bypass
Payload 3.0.0 to < 3.90.0 and canary < 4.0.0-canary.34 contains an access control bypass caused by duplicate operation copying values despite hidden fields or access rules, letting attackers bypass access restrictions, exploit requires crafted duplicate operation.
- 8.2 /10 HighCVE-2026-105850
Payload @payloadcms/plugin-ecommerce - Broken Authentication
Payload @payloadcms/plugin-ecommerce < 3.90.0 and canary < 4.0.0-canary.34 contains a logic flaw in Stripe payment adapter allowing multiple processing of Stripe order confirmations, letting attackers cause duplicate order processing, exploit requires specific payment conditions.
- 8.3 /10 HighCVE-2026-105849 Auth required
Payload - Broken Access Control
Payload 3.0.0 < 3.90.0 and canary < 4.0.0-canary.34 contain an information disclosure vulnerability caused by improper access control in authentication documents with useAPIKey enabled, letting users with read access obtain active API keys, exploit requires read access to authentication documents.
- 9.6 /10 CriticalCVE-2026-105848 Auth required
Payload @payloadcms/plugin-stripe - Broken Access Control
Payload @payloadcms/plugin-stripe < 3.90.0 and canary < 4.0.0-canary.34 contains a broken access control vulnerability caused by insufficient authorization on the Stripe REST proxy, letting authenticated users perform unintended Stripe operations, exploit requires user authentication.