Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 352 of 767

  • 9.8 /10 Critical
    CVE-2026-105207 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 contains an authentication bypass caused by linking user accounts to external identity providers without verifying primary factors or caller permissions, letting unauthenticated attackers bind external identities and sign in as victims, exploit requires knowledge of victim's login name.

  • 7.3 /10 High
    CVE-2026-105167 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a SQL injection caused by manipulation of the "location" argument in admin/donate.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105166 No auth

    kishor-23 food-waste-management-system - SQL Injection

    kishor-23 food-waste-management-system contains a sql injection caused by manipulation of the "image-choice" argument in the insert function of Food Donation Form component, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 7.3 /10 High
    CVE-2026-105158 No auth

    RainyGao DocSys - SQL Injection

    RainyGao DocSys <= 2.02.85 contains a sql injection caused by manipulation of the "url" argument in BaseController.createDBForMysql in Database Management, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105149 No auth

    mooSocial - SQL Injection

    mooSocial <= 3.2.4 contains a sql injection caused by manipulation of the "rating" argument in /stores/all-products, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105148 No auth

    SciPhi-AI R2R - Server-Side Request Forgery

    SciPhi-AI R2R <= 3.6.6 contains a server-side request forgery caused by manipulation of the argument generation_config.api_base in Retrieval Completion API Endpoint, letting remote attackers make arbitrary requests, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-105147 No auth

    SciPhi-AI R2R - Hardcoded Credentials

    SciPhi-AI R2R <= 3.6.6 contains a hardcoded credentials vulnerability caused by manipulation of DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY in JWT Secret Handler, letting remote attackers exploit hardcoded secrets.

  • 10.0 /10 Critical
    CVE-2026-105135 No auth

    InternLM MindSearch - Command Injection

    InternLM MindSearch 0.1.0 contains a command injection caused by manipulation of the "inputs" argument in ExecutionAction.run of Planner Agent, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-105134 CISA KEVPoC publicNo auth

    Ahsay AhsayCBS - Command Injection

    Ahsay AhsayCBS <= 10.3.2 contains a command injection caused by manipulation of the "random" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request.

  • 7.3 /10 High
    CVE-2026-105133 CISA KEVPoC publicNo auth

    Ahsay AhsayCBS - Authentication Bypass

    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.

  • 7.2 /10 High
    CVE-2026-105126 Auth required

    LaraDashboard - Broken Access Control

    LaraDashboard < 1.4.8 contains a broken access control vulnerability caused by improper privilege management in role editing, letting authenticated admin users escalate to superadmin and execute code, exploit requires admin privileges.

  • 8.8 /10 High
    CVE-2026-105123 Auth required

    W (vincent-peugnet/wcms) - Remote Code Execution

    W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution caused by unvalidated path in POST /api/v0/media/upload/[*:path], letting authenticated editors write arbitrary files including executable PHP, exploit requires authenticated editor privileges.

  • 8.7 /10 High
    CVE-2026-105089 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo through 29.2.0 contains a stored XSS caused by unescaped rendering of malicious video trailer1 URL in YouPHPFlix2 templates and channel playlists, letting users with upload permission execute JavaScript in victims' browsers.

  • 8.7 /10 High
    CVE-2026-105086 Auth required

    WWBN AVideo - Stored XSS

    WWBN AVideo 12.4 through 29.2.0 contains a stored XSS caused by improper handling of doubly-encoded entities in video titles, letting authenticated uploaders inject HTML that executes in multiple pages, exploit requires authenticated uploader privileges.

  • 9.3 /10 Critical
    CVE-2026-103355 PoC publicNo auth

    Unlimited Elements Unlimited Elements For Elementor - SQL Injection

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.20 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.