Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 339 of 767

  • 8.1 /10 High
    CVE-2025-45871 Auth required

    LogicalDOC Enterprise - SQL Injection

    LogicalDOC Enterprise <= 9.1.1 contains a blind SQL injection caused by manipulation of workflow template name in WorkflowsDataServlet, letting authenticated users manipulate SQL queries.

  • 7.1 /10 High
    CVE-2026-97309 Auth required

    Webful Creations RepairBuddy - Broken Access Control

    Webful Creations RepairBuddy <= 4.1226 contains a broken access control vulnerability caused by missing authorization checks, letting attackers retrieve embedded sensitive data, exploit requires no special privileges.

  • 7.6 /10 High
    CVE-2026-97303 Auth required

    Apps Mav Scratch & Win – Giveaways and Contests - Broken Access Control

    Apps Mav Scratch & Win – Giveaways and Contests <= 3.0.2 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-97283 No auth

    Liquid Web / StellarWP Advanced Post Manager - Insecure Deserialization

    Liquid Web / StellarWP Advanced Post Manager <= 4.5.5 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 8.8 /10 High
    CVE-2026-97257 Auth required

    PressTigers Simple Event Planner - Insecure Deserialization

    PressTigers Simple Event Planner <= 1.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-95265 No auth

    Feehi CMS - Server Side Request Forgery

    Feehi CMS 2.1.1 contains a server side request forgery caused by insufficient private-IP validation in the UEditor catchimage endpoint, letting attackers probe internal HTTP services, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-95263 Auth required

    Feehi CMS - Broken Access Control

    Feehi CMS 2.1.1 contains an incorrect access control vulnerability caused by lack of protection on the built-in super administrator account, letting low-privilege backend administrators change its password without the old password.

  • 8.2 /10 High
    CVE-2026-94201 No auth

    Ash - Denial of Service

    Ash 3.5.1 to < 3.34.3 contains a denial of service caused by unsafe atom interning in :atom-typed attributes with unsafe_to_atom?: true, letting attackers exhaust the atom table and crash the node, exploit requires attacker-controlled filter values.

  • 7.2 /10 High
    CVE-2026-93617 Auth required

    Sunshine Photo Cart - Insecure Deserialization

    Sunshine Photo Cart <= 3.7.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-93318

    BuildKit - Code Injection

    BuildKit contains a code injection vulnerability caused by trusting advertised DiffIDs without validating actual layer contents, letting attackers run malicious code in victim builds, exploit requires shared or persistent cache usage.

  • 7.1 /10 High
    CVE-2026-93316

    BuildKit - Denial of Service

    BuildKit daemon contains a denial of service caused by panic when builds use CDI devices while started with --cdi-disabled, letting attackers or accidental triggers crash the daemon, exploit requires daemon started with --cdi-disabled.

  • 8.8 /10 High
    CVE-2026-92931 No auth

    Progress @progress/sitefinity-nextjs-sdk - Server-Side Request Forgery

    Progress @progress/sitefinity-nextjs-sdk 15.1.8326 through 15.4.8637 contains a server-side request forgery caused by improper validation of URLs, letting remote attackers make server-side requests to attacker-controlled hosts, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-91107 Auth required

    openSIS Classic - Broken Access Control

    openSIS Classic 9.3 contains a broken access control vulnerability caused by improper authorization in the School Information update path, letting authenticated users with teacher role reset arbitrary staff passwords, exploit requires teacher role authentication.

  • 9.8 /10 Critical
    CVE-2026-88424 No auth

    FineAdmin - SQL Injection

    FineAdmin v1.0 contains a sql injection caused by unsanitized input in the field/order parameter at ButtonService.GetListByFilter(), letting attackers access sensitive database information via crafted SQL statements, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-88396 Auth required

    ApiAdmin - Remote Code Execution

    ApiAdmin <= 5.0 contains a directory traversal and unrestricted file upload vulnerability caused by lack of file extension validation in the admin file-upload endpoint, letting logged-in admin users execute remote code via uploaded PHP files.