Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 344 of 767

  • 7.3 /10 High
    CVE-2026-105651 Auth required

    Ghost - Stored XSS

    Ghost 5.94.0 to 6.64.0 contains a stored XSS caused by storing non-image files as bookmark icons or thumbnails, letting any staff user host arbitrary HTML on the site's domain, exploit requires staff user privileges.

  • 8.1 /10 High
    CVE-2026-105650 No auth

    Ghost - Stored XSS

    Ghost 2.1.0 to 6.64.0 contains a stored XSS caused by embedding URLs from attacker-controlled websites in post content, letting attackers execute scripts in editor, site, and emails, exploit requires crafted post content.

  • 7.3 /10 High
    CVE-2026-105649 Auth required

    Ghost - Stored XSS

    Ghost 4.22.0 to 6.65.0 contains a stored XSS caused by unsanitized SVG media thumbnails and SVG images uploaded with non-SVG extensions, letting staff users host scripts on the site domain, exploit requires staff user privileges.

  • 7.3 /10 High
    CVE-2026-105643 Auth required

    Ghost - Stored XSS

    Ghost 6.34.0 to 6.67.0 contains a stored cross-site scripting caused by insufficient sanitization of embed cards in the editor, letting any staff user execute scripts in other staff users' admin sessions, exploit requires staff user privileges.

  • 8.8 /10 High
    CVE-2026-105642 No auth

    Ghost - Command Injection

    Ghost 6.56.0 to 6.67.0 contains a command injection caused by vulnerable SVG handling in an image processing library, letting any staff user execute arbitrary commands on the server, exploit requires staff user privileges.

  • 9.8 /10 Critical
    CVE-2026-105641 No auth

    Plane - Authentication Bypass

    Plane prior to 1.4.0 contains a broken authentication caused by fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in deployment manifests, letting attackers forge Django-signed values and bypass live-service authentication, exploit requires unchanged default secrets.

  • 9.1 /10 Critical
    CVE-2026-105640 No auth

    Plane - Authentication Bypass

    Plane prior to 1.4.0 contains an authentication bypass caused by trusting unverified email addresses from Gitea and self-managed GitLab OAuth without ownership verification, letting attackers log in as victims, exploit requires unverified OAuth email.

  • 9.8 /10 Critical
    CVE-2026-105639 No auth

    Plane - Authentication Bypass & Broken Access Control

    Plane < 1.4.0 contains an authentication bypass caused by lack of out-of-band email ownership verification in signup flow, letting unauthenticated attackers register as target users and join workspaces via invitation tokens, exploit requires attacker to register with target email.

  • 9.1 /10 Critical
    CVE-2026-105638 No auth

    Plane - Authentication Bypass

    Plane < 1.4.0 contains an authentication bypass caused by insufficient OTP verification and lack of rate limiting in magic-code email login, letting attackers brute force OTP codes without lockout, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-105637 Auth required

    Plane - Broken Access Control

    Plane prior to 1.4.0 contains a broken access control vulnerability caused by missing project_id constraint in asset retrieval, letting workspace Guests reassign assets to attacker-controlled projects and obtain presigned download URLs, exploit requires guest access in the workspace.

  • 9.9 /10 Critical
    CVE-2026-105636 Auth required

    Plane - Server Side Request Forgery

    Plane < 1.4.0 contains a server-side request forgery caused by lack of redirect target validation in webhook delivery task, letting authenticated users access internal resources via redirects, exploit requires workspace creation privilege.

  • 7.4 /10 High
    CVE-2026-105635

    Plane - Broken Access Control

    Plane < 1.4.0 contains a broken access control caused by ProjectJoinEndpoint allowing unauthenticated access to full ProjectMemberInvite records and insufficient validation on POST, letting attackers accept invitations without original invite, exploit requires knowing invitation UUID.

  • 8.1 /10 High
    CVE-2026-105634 Auth required

    Plane - Broken Access Control

    Plane < 1.3.0 contains a broken access control vulnerability caused by insufficient authorization checks in ProjectMemberViewSet.partial_update, letting project members with GUEST role demote other members, exploit requires being a project member.

  • 7.1 /10 High
    CVE-2026-105633 Auth required

    Plane - Broken Access Control

    Plane prior to 1.4.0 contains a broken access control caused by improper validation of issue_id in the V2 issue-attachment PATCH endpoint, letting project members modify attachments they do not own, exploit requires project membership.

  • 8.7 /10 High
    CVE-2026-105632 Auth required

    Plane - Broken Access Control

    Plane prior to 1.4.0 contains a broken access control caused by insufficient project visibility checks in the GraphQL joinProject mutation, letting any workspace member add themselves to private projects with full Member role, exploit requires workspace membership.