Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 346 of 767
- 7.3 /10 HighCVE-2026-105307 No auth
Casdoor - Authentication Bypass
Casdoor <= 3.161.1 contains an authentication bypass caused by manipulation in ApiFilter function in routers/authz_filter.go API Endpoint, letting remote attackers bypass authentication, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-105295
GitAhead - Remote Code Execution
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism caused by lack of integrity and signature verification and ignoring TLS errors, letting network attackers execute code as the user via fake updates, exploit requires attacker to intercept update checks.
- 7.4 /10 HighCVE-2026-105294 No auth
Legcord - Configuration Injection
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability caused by improper validation in window.legcord settings.setConfig bridge, letting attackers exploiting Discord XSS persistently modify client config, exploit requires Discord XSS.
- 8.1 /10 HighCVE-2026-105293 No auth
Legcord - Path Traversal
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability caused by unvalidated theme IDs in theme IPC handlers, letting attackers running script in Discord origin execute local files and modify directories, exploit requires script execution in Discord origin.
- 7.3 /10 HighCVE-2026-105290 No auth
feelec-yishu feelcrm-os - Server-Side Request Forgery
feelec-yishu feelcrm-os 1.0.0 contains a server-side request forgery caused by manipulation of the "url" argument in getCurlData Endpoint of GoogleController.class.php, letting remote attackers make arbitrary requests, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-105285 No auth
Totolink A3002MU - Buffer Overflow
Totolink A3002MU 1.0.0-B20230403.1455 contains a stack-based buffer overflow caused by manipulation of the addQos/comment/entry_name argument in /boafrm/formIpQoS QoS Rule Handler, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-105284 No auth
Totolink A3002MU - Authentication Bypass
Totolink A3002MU 1.0.0-B20230403.1455 contains an improper authorization vulnerability caused by manipulation in the Authentication Check function sub_40FCFC in /bin/boa, letting remote attackers bypass authorization, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105253 No auth
itsourcecode Online Admission System Project - SQL Injection
itsourcecode Online Admission System Project 1.0 contains a sql injection caused by manipulation of the "User" argument in /admin/login1.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105247 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a sql injection caused by manipulation of the "Subject" argument in /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105246 No auth
SourceCodester Online Reviewer Management System - SQL Injection
SourceCodester Online Reviewer Management System 1.0 contains a SQL injection caused by manipulation of the "Subject" argument in /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105238 No auth
ChatGPTNextWeb NextChat - Server-Side Request Forgery
ChatGPTNextWeb NextChat <= 2.16.1 contains a server-side request forgery caused by manipulation of the "x-base-url" argument in app/api/proxy.ts Proxy Fallback Handler, letting remote attackers initiate SSRF, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105232 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of username/email/location arguments in delivery/deliverysignup.php Registration Page, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105231 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of email, username, or location arguments in admin/signup.php Admin Registration component, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-105230 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of "delivery_person_id" or "order_id" arguments in delivery/deliverymyord.php, letting remote attackers execute arbitrary SQL queries, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105229 No auth
kishor-23 food-waste-management-system - SQL Injection
kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of email, name, or gender arguments in signup.php User Registration Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.