Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 372 of 767

  • 7.2 /10 High
    CVE-2026-55231 Auth required

    Vvveb - Path Traversal

    Vvveb < 1.0.8.6 contains a path traversal caused by a flawed central path sanitizer, letting authenticated admin-panel users with backup access read and delete arbitrary files, exploit requires admin-panel backup access.

  • 8.7 /10 High
    CVE-2026-55230 Auth required

    Vvveb - Stored XSS

    Vvveb < 1.0.8.6 contains a stored XSS caused by improper HTML sanitization failing to strip event-handler attributes with > character in quoted values, letting low-privilege content authors execute JavaScript in visitors' and admins' browsers, exploit requires author or contributor role.

  • 9.1 /10 Critical
    CVE-2026-55083 Auth required

    DHIS2 - Remote Code Execution

    DHIS2 2.42.0 < 2.42.5.1, 2.43.0 < 2.43.0.1 contains a remote code execution caused by unsafe Java deserialization, letting remote attackers execute arbitrary code, exploit requires crafted input to the deserialization component.

  • 8.7 /10 High
    CVE-2026-54049 Auth required

    Sakai - Stored XSS

    Sakai 23.0 < 23.5, 25.0 < 25.3 contains a stored XSS caused by lack of HTML sanitization in Conversations tool messages and unsafe rendering with LitElement's unsafeHTML(), letting authenticated users inject arbitrary scripts executed by other users, exploit requires authenticated user access to Conversations tool.

  • 7.2 /10 High
    CVE-2026-53964 Auth required

    Document Merge Service - Remote Code Execution

    Document Merge Service < 9.1.0 contains a server-side template injection caused by unsafe processing of XLSX templates using npn-sandboxed Jinja environment, letting remote attackers execute code as document-merge-server user, exploit requires crafted XLSX template.

  • 9.1 /10 Critical
    CVE-2026-53953 No auth

    GetSimple CMS - Authentication Bypass

    GetSimple CMS CE 3.3.22 contains a broken authentication caused by predictable temporary password generation using PHP rand() seeded with microtime() in the password reset endpoint, letting attackers perform administrator account takeover, exploit requires no authentication but relies on timing attack.

  • 9.8 /10 Critical
    CVE-2026-51897

    RAGFlow - Broken Access Control

    RAGFlow 0.24.0 contains a broken access control vulnerability in get_dataset (api/apps/evaluation_app), letting attackers execute arbitrary code or commands, exploit requires access to the exposed entry point.

  • 9.8 /10 Critical
    CVE-2026-51893 No auth

    Infiniflow Ragflow - Broken Access Control

    Infiniflow Ragflow 0.24.0 contains an incorrect access control vulnerability caused by trace_mindmap accepting caller-selected tenant identifiers without ownership or membership checks, letting external attackers access unauthorized data.

  • 7.5 /10 High
    CVE-2026-51888 No auth

    langflow-ai langflow - Path Traversal

    langflow-ai langflow <= 1.8.4 contains a path traversal caused by lack of boundary enforcement in knowledge_bases-create_knowledge_base HTTP POST endpoint, letting attackers write files outside intended workspace, exploit requires HTTP access.

  • 9.8 /10 Critical
    CVE-2026-51886 CISA KEVNo auth

    langflow-ai langflow - Code Injection

    langflow-ai langflow <= 1.9.3 contains a code injection caused by lack of sandboxing in /api/v1/validate/code endpoint, letting authenticated attackers execute arbitrary Python code remotely, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-51884 No auth

    Langchain Chatchat - Path Traversal

    Langchain Chatchat 0.3.1 contains a path traversal caused by crafted malicious filenames in /knowledge_base/upload_temp_docs endpoint, letting attackers write files to arbitrary server locations, exploit requires crafted filenames.

  • 9.1 /10 Critical
    CVE-2026-51883 No auth

    Langchain-Chatchat - Path Traversal

    Langchain-Chatchat 0.3.0;0.3.1 contains a path traversal caused by injection of path traversal sequences in the knowledge_base_name parameter, letting attackers write files outside the knowledge base root directory, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-51882 No auth

    Langchain-Chatchat - Path Traversal

    Langchain-Chatchat 0.3.0 contains a path traversal caused by crafted malicious filenames in the /v1/files upload endpoint, letting attackers write files outside the intended directory, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51881 No auth

    deeptutor - Command Injection

    deeptutor 1.4.0 contains a command injection caused by unsanitized input in ExecTool.execute, letting remote attackers execute arbitrary shell commands via the live tutorbot WebSocket interface, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-51880 No auth

    deeptutor - Path Traversal

    deeptutor 1.4.0 contains a path traversal caused by improper validation in EditFileTool.execute, letting remote attackers write or edit files outside the intended workspace via the live tutorbot WebSocket interface, exploit requires network access.