Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 40 of 891

  • 8.9 /10 High
    CVE-2026-61719 Auth required

    WeGIA - Stored XSS

    WeGIA < 3.8.7 contains a stored XSS caused by improper sanitization of the textoProntuario field in saude/historico_prontuarios.php, letting attackers with access to patient records execute scripts in victim browsers, exploit requires record access.

  • 9.0 /10 Critical
    CVE-2026-61707 Auth required

    SOCFortress CoPilot - Server-Side Template Injection

    SOCFortress CoPilot < 0.1.76 contains a server-side template injection caused by insufficient validation and non-sandboxed Jinja2 template rendering, letting low-privilege users execute arbitrary code as root, exploit requires attacker to upload malicious templates.

  • 8.1 /10 High
    CVE-2026-61671 Auth required

    WeGIA - Broken Access Control

    WeGIA < 3.8.7 contains a broken access control vulnerability caused by lack of record ownership verification and insufficient CSRF protection in Controle CRUD methods, letting authenticated users view, modify, or delete other users' sensitive records, exploit requires authentication.

  • 8.3 /10 High
    CVE-2026-61654 No auth

    Lightdash - Path Traversal

    Lightdash <= 0.3213.0 contains a path traversal vulnerability in the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook caused by unsanitized accountId interpolation in server-side API requests, letting unauthenticated attackers influence API request paths and create previews, exploit requires knowledge of projectUuid in dbt Cloud IDE projects.

  • 9.1 /10 Critical
    CVE-2026-61645 Auth required

    Docat - Unrestricted File Upload

    Docat contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file path or type in the Upload API, letting attackers overwrite sensitive files or upload malicious content, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-61576 No auth

    Lightdash - Path Traversal

    Lightdash <= 0.3213.0 contains a path traversal vulnerability in the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook caused by unsanitized accountId interpolation in server-side API requests, letting unauthenticated attackers influence API request paths and create previews, exploit requires knowledge of projectUuid.

  • 7.1 /10 High
    CVE-2026-54866 No auth

    Razorpay Payment Button Elementor Plugin - Reflected XSS

    Razorpay Payment Button Elementor Plugin <= 1.2.8 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-54864 No auth

    Post Video Players - Reflected XSS

    Post Video Players <= 1.165 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54860 No auth

    Ozisti - Insecure Deserialization

    Ozisti <= 1.1.10 contains an unauthenticated PHP object injection caused by improper handling of user input, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54859 No auth

    Preservation - PHP Object Injection

    Preservation <= 1.15 contains an unauthenticated PHP Object Injection caused by unsafe deserialization, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54858 No auth

    Printy - PHP Object Injection

    Printy <= 1.13.0 contains an unauthenticated PHP Object Injection caused by unsafe deserialization, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54857 No auth

    Quirky - Insecure Deserialization

    Quirky <= 1.23 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54856 No auth

    RexCoin - PHP Object Injection

    RexCoin <= 1.2.6 contains an unauthenticated PHP Object Injection caused by improper handling of serialized objects, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-51905 Auth required

    TransformerOptimus SuperAGI - Broken Access Control

    TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by missing organization ownership checks in get_agent_execution_configuration endpoint, letting remote authenticated attackers read other organizations' agent execution configurations, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-49142 Auth required

    OpenEMR - SQL Injection

    OpenEMR < 8.5.0 contains an authenticated SQL injection caused by crafted values in the form_icd_codes[] POST parameter in Syndromic Surveillance module, letting Clinician-level users read and modify database contents and take over admin accounts.