Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 34 of 677
- 7.8 /10 HighCVE-2026-106931 Auth required
SiteGuard Server Edition - Command Injection
SiteGuard Server Edition contains an OS command injection caused by improper input handling, letting attackers execute arbitrary OS commands with root or SYSTEM privileges, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-106599 Auth required
Brainstorm Force SureCart - Insecure Deserialization
Brainstorm Force SureCart <= 4.9.3 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.7 /10 HighCVE-2026-106465 No auth
NetX Secure DTLS - Authentication Bypass
NetX Secure DTLS server contains a broken authentication caused by improper cookie verification in ClientHello parser, letting attackers bypass return-routability checks and complete handshakes with forged source addresses, exploit requires sending crafted ClientHello with any single cookie byte.
- 8.7 /10 HighCVE-2026-106464 No auth
Generic TLS Implementation - Out of Bounds Read
Affected software contains a buffer parsing vulnerability caused by improper length validation in _nx_secure_x509_parse_signature_data, letting remote attackers cause out-of-bounds read during TLS handshake, exploit requires crafted certificate input.
- 7.1 /10 HighCVE-2026-105874 No auth
Brainstorm Force SureCart - Reflected XSS
Brainstorm Force SureCart <= 4.9.3 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 8.7 /10 HighCVE-2026-105659 No auth
Bandit - Uncontrolled Resource Consumption
Bandit >= 1.4.0 contains an uncontrolled resource consumption vulnerability caused by indefinite pinning of HTTP/2 stream processes via small WINDOW_UPDATE frames, letting unauthenticated remote attackers exhaust server resources, exploit requires continuous trickle of WINDOW_UPDATE frames.
- 8.0 /10 HighCVE-2026-105429 Auth required
NetBird - Command Injection
NetBird 0.60.0 through 0.74.6 contains a command injection caused by improper neutralization of special elements in SSH configuration manager, letting malicious peers execute arbitrary commands on other client hosts, exploit requires malicious or compromised peer.
- 7.6 /10 HighCVE-2026-105107 Auth required
Koha - SQL Injection
Koha < 24.11.19, 25.05.14, 25.11.08, 26.05.03 contains an SQL injection caused by unsanitized user input in reports/cat_issues_top.pl script, letting authenticated staff users with reports module permission execute arbitrary SQL and read sensitive data, exploit requires authenticated staff user with reports permission.
- 8.8 /10 HighCVE-2026-105106 Auth required
Koha - Command Injection
Koha contains a command injection caused by improper validation of the jobid parameter in Task Scheduler deletion path, letting authenticated staff users with schedule_tasks permission execute arbitrary OS commands, exploit requires authenticated staff user privileges.
- 8.5 /10 HighCVE-2026-105067 Auth required
Webnus Modern Events Calendar Lite - SQL Injection
Webnus Modern Events Calendar Lite < 7.37.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 7.1 /10 HighCVE-2026-105066 No auth
SimplyRETS SimplyRETS Real Estate IDX - Reflected XSS
SimplyRETS SimplyRETS Real Estate IDX <= 3.2.9 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 8.1 /10 HighCVE-2026-104995 No auth
WordPress BP Profile Search - Local File Inclusion
BP Profile Search plugin for WordPress <= 5.9 contains a local file inclusion vulnerability caused by improper validation of the 'ajax_template' value from the 'bps_directory' cookie during BuddyPress AJAX requests, letting unauthenticated attackers include arbitrary PHP files, exploit requires attacker control over HTTP_REFERER and cookie.
- 7.5 /10 HighCVE-2026-104939 No auth
NGINX Ingress Controller - Authentication Bypass
NGINX Ingress Controller contains an authentication bypass caused by mishandling HTTP responses from an OAuth IdP in externalAuth policy, letting remote attackers gain unauthenticated access to protected paths, exploit requires crafted OAuth response.
- 8.1 /10 HighCVE-2026-104909 No auth
Mang Board WordPress Plugin - Local File Inclusion
Mang Board WordPress plugin <= 2.4.3 contains a local file inclusion caused by improper validation of '<mode>_type' parameter, letting unauthenticated attackers execute arbitrary PHP code, exploit requires unauthenticated POST to pages with [mb_board] shortcode.
- 9.8 /10 CriticalCVE-2026-104800 No auth
AGE-GATE WordPress plugin - Remote Code Execution
AGE-GATE WordPress plugin <= 1.0 contains a remote code execution caused by missing authentication and unsanitized POST parameter injection in admin.php, letting unauthenticated attackers execute code on the server.