Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 334 of 767

  • 9.1 /10 Critical
    CVE-2026-105793 Auth required

    Microsoft UFO - Command Injection

    Microsoft UFO < 3.0.9 contains a command injection caused by unsanitized key_code parameter in press_key tool, letting authenticated Mobile MCP callers execute commands as Android shell user on authorized devices, exploit requires valid API key, adb, and authorized device.

  • 7.5 /10 High
    CVE-2026-105791 No auth

    Microsoft UFO - Command Injection

    Microsoft UFO < 3.0.9 contains a command injection caused by improper validation of the bash_command parameter in CommandLineExecutor, letting attackers execute arbitrary code as the desktop user, exploit requires user to run affected agent workflow.

  • 8.8 /10 High
    CVE-2026-105788 Auth required

    Microsoft UFO - Command Injection

    Microsoft UFO < 3.0.10 contains a command injection caused by insufficient validation of caller-controlled text and package_name parameters in adb shell commands, letting authenticated users execute arbitrary commands on authorized Android devices, exploit requires valid Mobile MCP API key and authorized device.

  • 8.5 /10 High
    CVE-2026-105786 No auth

    Joplin - Authentication Bypass

    Joplin prior to 3.7.13 contains an authentication bypass caused by improper binding of application authorization identifiers, letting attackers obtain victim sessions with full read/write access, exploit requires victim interaction to approve attacker's identifier.

  • 8.0 /10 High
    CVE-2026-105783 No auth

    Joplin Desktop - Broken Access Control

    Joplin Desktop < 3.7.13 contains a broken access control vulnerability caused by the Web Clipper server allowing arbitrary origins to access pairing endpoints without origin validation, letting attackers obtain permanent API tokens, exploit requires victim approval of a generic prompt.

  • 7.5 /10 High
    CVE-2026-105782 No auth

    Scrapy - Command Injection

    Scrapy 1.4.0 to 2.14.2 contains a command injection caused by unsafe import and execution of Referrer-Policy header values in RefererMiddleware, letting attackers terminate the crawler process remotely, exploit requires processing malicious response.

  • 9.9 /10 Critical
    CVE-2026-105778 Auth required

    Tenda AC5 - Buffer Overflow

    Tenda AC5 02.03.01.111_multi contains a stack-based buffer overflow caused by manipulation of the "wifiPwd" argument in /goform/setWifi Wifi Handler, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105776 No auth

    bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL - SQL Injection

    bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL contains a SQL injection caused by manipulation of the "Username" argument in /admin_transaction.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

  • 7.7 /10 High
    CVE-2026-105764 Auth required

    Immich - Remote Code Execution

    Immich < 3.2.4 contains a remote code execution caused by improper SVG file handling in thumbnail generation, letting authenticated non-admin users execute code in the server container, exploit requires authenticated non-admin user.

  • 9.6 /10 Critical
    CVE-2026-105763 Auth required

    Twenty - Information Disclosure

    Twenty 1.20.10 to 2.7.0 contains an information disclosure caused by unprotected /metadata GraphQL connectedAccounts query exposing plaintext passwords, letting workspace members access other members' external-service credentials, exploit requires membership in the workspace.

  • 8.3 /10 High
    CVE-2026-105762 No auth

    Dify - Server Side Request Forgery

    Dify < 1.13.0 contains a server-side request forgery caused by unauthenticated URL input in /console/api/remote-files/upload endpoint, letting remote attackers access internal services or cloud metadata, exploit requires no authentication.

  • 7.3 /10 High
    CVE-2026-105704 No auth

    SourceCodester Drug Recommendation System - Authentication Bypass

    SourceCodester Drug Recommendation System 1.0 contains an authentication bypass caused by manipulation of the "user_id" argument in Auth Guard, letting remote attackers bypass authentication, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-105701 Auth required

    ACPT (Premium) WordPress - Remote Code Execution

    ACPT (Premium) WordPress plugin <= 2.0.66 contains a remote code execution caused by missing capability check and unsandboxed Twig rendering in REST API form creation endpoint, letting authenticated attackers with subscriber access execute code on the server.

  • 7.3 /10 High
    CVE-2026-105571 No auth

    PickMall Lilishop - Broken Access Control

    PickMall Lilishop <= 4.2.4 contains a broken access control caused by manipulation of the Username argument in /buyer/passport/member/bindMobile, letting remote attackers bypass authorization, exploit requires no special privileges.

  • 7.1 /10 High
    CVE-2026-105488 Auth required

    Devolutions Server - Broken Access Control

    Devolutions Server <= 2026.3.7.0 contains a broken access control caused by missing authorization in the global vault, letting authenticated users with global vault view permission modify and delete global contacts and folders, exploit requires authenticated user with specific permission.