Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 387 of 767

  • High
    CVE-2026-55224 No auth

    MineAdmin - Path Traversal to Remote Code Execution

    MineAdmin before 3.2.0-alpha.2 contains a path traversal vulnerability in the app-store plugin service where the identifier parameter is unsanitized in filesystem paths, allowing attackers to execute arbitrary code.

  • 9.4 /10 Critical
    CVE-2026-55181 No auth

    Tugtainer - Authentication Bypass

    Tugtainer < 1.30.3 contains an authentication bypass caused by OIDC login flow initiation despite OIDC_ENABLED=false, letting attackers bypass OIDC disable switch, exploit requires no special privileges.

  • 9.0 /10 Critical
    CVE-2026-55176

    Soft Machine - Broken Access Control

    Soft Machine <= 0.2.247 contains a broken access control vulnerability caused by acceptance of a global shared secret as bearer token without workspace verification, letting tenants access and modify other tenants' workspace APIs, exploit requires access to user-facing process environment.

  • 10.0 /10 Critical
    CVE-2026-55107 No auth

    Kobako Ruby gem - Remote Code Execution

    Kobako Ruby gem >= 0.1.0 and < 0.9.1 contains a remote code execution caused by sandbox escape allowing guest mruby scripts to execute arbitrary Ruby in the host process, letting attackers fully escape the sandbox, exploit requires running untrusted mruby scripts.

  • 7.8 /10 High
    CVE-2026-53605 Auth required

    Reachy Mini ISO for Wireless - Privilege Escalation

    Reachy Mini ISO for Wireless < 0.2.4 contains a local privilege escalation caused by an overly broad sudoers entry granting pollen daemon user passwordless sudo access to /usr/bin/systemctl without restrictions, letting local attackers escalate to root, exploit requires local pollen user privileges.

  • 9.8 /10 Critical
    CVE-2026-51872 No auth

    Devika - Code Injection

    Devika v1.0 contains a code injection caused by improper handling in Runner.run_code function in src/agents/runner/runner.py, letting attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51871 No auth

    Devika - Command Injection

    Devika v1.0 contains a code injection caused by direct execution of LLM-generated content in Runner.execute function, letting attackers achieve arbitrary code execution, exploit requires crafted input to the function.

  • 9.8 /10 Critical
    CVE-2026-51870 No auth

    DeepTutor - Command Injection

    DeepTutor v1.4.0 contains a command injection caused by improper handling in /tutorbot/agent/tools/shell.py:ExecTool.execute, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51869 No auth

    DB-GPT - Command Injection

    DB-GPT v0.8.0 contains a command injection caused by silent fallback to LocalRuntime in sandbox API, letting attackers execute code on the host, exploit requires invoking the sandbox API.

  • 9.8 /10 Critical
    CVE-2026-51867 No auth

    AgentGPT - Broken Access Control

    AgentGPT 1.0.0 contains an incorrect access control vulnerability caused by lack of ownership or membership binding in next/src/server/api/routers/agentRouter.ts, letting external attackers access data without proper authorization, exploit requires external network access.

  • 9.8 /10 Critical
    CVE-2026-51866 No auth

    DB-GPT - Unrestricted File Upload

    DB-GPT 0.7.5 and 0.8.0 contain an unrestricted file upload vulnerability caused by skill upload via /api/v1/skills/upload, letting attackers execute uploaded skills through /api/v1/chat/react-agent, exploit requires skill upload access.

  • 9.1 /10 Critical
    CVE-2026-51864 No auth

    DB-GPT - Path Traversal

    DB-GPT v0.7.5 and v0.8.0 contain a path traversal caused by improper validation in python_file_upload, letting remote attackers write files outside intended workspace, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-51862 No auth

    DB-GPT - Path Traversal

    DB-GPT 0.8.0 contains a path traversal vulnerability caused by improper validation in skill_upload, letting remote attackers write files outside intended workspace, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-51861 No auth

    Bisheng - Command Injection

    Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 contain a code injection caused by improper input handling in src/backend/bisheng/api/v1/validate.py, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-51860 No auth

    Bisheng - Directory Traversal

    Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 contain a directory traversal vulnerability caused by improper input validation in src/backend/bisheng/linsight/domain/task_exec.py, letting attackers access arbitrary files, exploit requires crafted input.