Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 476 of 695
- 7.2 /10 HighCVE-2026-54647 Auth required
CubeCart - SQL Injection
CubeCart prior to 6.7.5 contains a SQL injection caused by direct concatenation of administrator-controlled download_expire POST parameter in admin/sources/settings.index.inc.php, letting authenticated administrators manipulate database columns, exploit requires administrator privileges.
- 7.2 /10 HighCVE-2026-54646 Auth required
CubeCart - SQL Injection
CubeCart < 6.7.5 contains a SQL injection caused by improper validation and escaping of administrator-controlled tablename values in SQL statements, letting authenticated administrators compromise database confidentiality, integrity, and availability, exploit requires administrator privileges.
- 7.3 /10 HighCVE-2026-54634 No auth
Hamlib - Buffer Overflow & Information Disclosure
Hamlib < 4.7.2 contains a buffer overflow and information disclosure caused by out-of-bounds write and oversized copy in rigctld send_raw command, letting remote unauthenticated clients crash daemon or leak stack data.
- 9.8 /10 CriticalCVE-2026-54627 No auth
SAIL - Buffer Overflow
SAIL <= 0.9.10 contains a heap buffer overflow caused by a mode/depth mismatch in PSD Bitmap color mode handling, letting attackers trigger memory corruption or potential code execution by loading crafted PSD files, exploit requires crafted PSD input.
- 9.8 /10 CriticalCVE-2026-54626 No auth
SAIL - Buffer Overflow
SAIL <= 0.9.10 contains a heap buffer overflow caused by inconsistent pixel size calculation in TGA_INDEXED_RLE image loading, letting attackers cause heap corruption or code execution via crafted TGA files, exploit requires crafted file input.
- 9.4 /10 CriticalCVE-2026-54618
Obsidian Web MCP - Authentication Bypass
Obsidian Web MCP < 0.2.0 contains an authentication bypass caused by missing login, consent, and session checks in /oauth/authorize and /oauth/token endpoints, letting unauthenticated remote attackers fully access vault operations, exploit requires network access to the tunnel deployment.
- 9.8 /10 CriticalCVE-2026-54617 No auth
GravitLauncher - Path Traversal
GravitLauncher < 5.7.12 contains a path traversal caused by improper request-target handling in FileServerHandler, letting unauthenticated remote attackers read arbitrary files, exploit requires direct access to LaunchServer on port 9274.
- 8.8 /10 HighCVE-2026-54612 Auth required
Vvveb - Remote Code Execution
Vvveb 1.0.0 to 1.0.8.5 contains a file inclusion vulnerability caused by concatenation of attacker-controlled data-v-save-global file path in saveGlobalElements(), letting authenticated editors execute arbitrary PHP code remotely, exploit requires editor role with editor/* permission.
- 8.3 /10 HighCVE-2026-54597 PoC publicAuth required
ITFlow - SQL Injection
ITFlow < 26.07 contains a time-based blind SQL injection caused by unquoted insertion of the expires parameter in the share_generate_link handler in agent/ajax.php, letting authenticated users with module_support write permission extract sensitive data and potentially take over administrative accounts, exploit requires module_support write permission and access to a credential record.
- 8.1 /10 HighCVE-2026-54596 PoC publicAuth required
ITFlow - SQL Injection
ITFlow < 26.07 contains a SQL injection caused by improper sanitization of the frequency parameter in agent/post/recurring_invoice.php, letting authenticated Technicians inject SQL to expose and modify sensitive data, exploit requires authenticated Technician or higher with access to a client invoice.
- 8.1 /10 HighCVE-2026-54520 PoC publicAuth required
AI Agent Automation - Path Traversal
AI Agent Automation < 0.9.1 contains a path traversal caused by insufficient validation of user-controlled step.path in executeStep file-step, letting authenticated users read or write files outside the intended workflow directory.
- 8.8 /10 HighCVE-2026-54519 PoC publicAuth required
AI Agent Automation - Broken Access Control
AI Agent Automation < 0.9.1 contains a broken access control caused by lack of verification of agentId or memory _id ownership in memory.controller.js, letting authenticated attackers access or delete other users' AgentMemory, exploit requires attacker to be authenticated and know victim identifiers.
- 7.1 /10 HighCVE-2026-54510 No auth
Speakr - Authentication & CSRF Bypass
Speakr < 0.8.21-alpha contains a broken authentication caused by improper token validation and permanent CSRF exemption in Flask-WTF, letting network attackers bypass CSRF and modify user/admin data, exploit requires attacker-controlled sibling subdomain and crafted cross-origin requests.
- 7.6 /10 HighCVE-2026-54506 Auth required
Vvveb - Stored XSS
Vvveb < 1.0.8.5 contains a stored XSS caused by improper sanitization of user[bio] field in profile.php, letting author or higher users execute JavaScript in admin and public views, exploit requires author role or higher.
- 8.8 /10 HighCVE-2026-54504
MCP Documentation Server - Authentication Bypass
MCP Documentation Server 1.13.0 to 1.13.1 contains an authentication bypass caused by binding the document-management API to all network interfaces, letting network-reachable attackers enumerate, read, insert, delete, and tamper documents without credentials, exploit requires network access to the service.