Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 499 of 681
- 8.1 /10 HighCVE-2026-91988
atomic-agents-stack - Command Injection
atomic-agents-stack < 1.1.0 contains a command injection caused by acceptance of cleartext HTTP schemes in the HTTP MCP server-registry backend factory, letting network man-in-the-middle attackers execute arbitrary commands on the agent host, exploit requires man-in-the-middle position.
- 7.5 /10 HighCVE-2026-91985 No auth
Vikunja - Broken Access Control
Vikunja < 2.6.0 contains a broken access control caused by improper restriction of link-share hash field in single-share read endpoints, letting read-only members escalate privileges to perform unauthorized writes or admin actions, exploit requires read-only membership.
- 7.5 /10 HighCVE-2026-91973 No auth
Vikunja - Authentication Bypass
Vikunja < 2.6.0 contains an authentication bypass caused by lack of rate limiting in CalDAV BasicAuth endpoints, letting remote unauthenticated attackers bypass anti-brute-force controls and compromise password-only accounts.
- 7.5 /10 HighCVE-2026-91972 No auth
Vikunja - Authentication Bypass
Vikunja < 2.6.0 contains a broken authentication caused by lack of rate limiting on /api/v2 public authentication endpoints, letting remote unauthenticated attackers perform credential guessing, account enumeration, and password-reset flooding without throttling.
- 7.5 /10 HighCVE-2026-91965 No auth
WWBN AVideo - Broken Access Control
WWBN AVideo through 29.0 contains a broken access control caused by failure to enforce user-group restrictions in plugin/Live/stats.json.php and plugin/Live/calendar.json.php, letting unauthenticated attackers retrieve restricted live transmission details including stream keys and playback URLs, exploit requires no authentication.
- 8.8 /10 HighCVE-2026-91964 No auth
FreeRDP - Buffer Overflow
FreeRDP < 3.31.0 contains a heap-based buffer overflow caused by improper validation of LoadBalanceInfo fields in Server Redirection PDU messages, letting malicious RDP servers cause client crashes or potential code execution, exploit requires malicious server.
- 7.5 /10 HighCVE-2026-91955 PoC publicNo auth
FreeRDP - Denial of Service
FreeRDP < 3.31.0 contains a denial of service caused by improper validation of client-supplied DesktopWidth and DesktopHeight during GCC negotiation, letting remote attackers crash the server by sending crafted RDP packets.
- 9.3 /10 CriticalCVE-2026-91949 PoC publicNo auth
FreeRDP - Authentication Bypass
FreeRDP server < 3.31.0 contains a protocol negotiation bypass caused by improper handling of incompatible protocol requests, letting unauthenticated attackers establish RDSTLS connections despite server policy, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-91948 Auth required
FreeRDP - Out-of-Bounds Write
FreeRDP < 3.31.0 contains an out-of-bounds write vulnerability caused by improper handling of oversized channel messages in server-side static virtual channel with CHANNEL_OPTION_SHOW_PROTOCOL enabled, letting authenticated clients potentially execute code.
- 7.5 /10 HighCVE-2026-91947 Auth required
FreeRDP - Use After Free
FreeRDP server < 3.31.0 contains a use-after-free vulnerability caused by dereferencing a channel pointer after releasing synchronization lock in DRDYNVC parser, letting authenticated clients trigger heap-use-after-free via race condition.
- 7.7 /10 HighCVE-2026-91943 Auth required
Crawl4AI - Server-Side Request Forgery
Crawl4AI < 0.9.3 contains a server-side request forgery caused by _get_pdf_path() re-downloading targets without egress validation in PDFContentScrapingStrategy, letting authenticated attackers access internal services and exfiltrate data.
- 7.5 /10 HighCVE-2026-91941 No auth
Crawl4AI - Denial of Service
Crawl4AI < 0.9.3 contains a denial of service caused by uncontrolled resource consumption in PDFContentScrapingStrategy, letting untrusted clients exhaust disk, CPU, and bandwidth by downloading large remote PDFs, exploit requires attacker to select PDF scraping strategy in POST requests.
- 7.5 /10 HighCVE-2026-91940 PoC publicNo auth
crawl4ai - Arbitrary File Write
crawl4ai < 0.9.3 contains an arbitrary file write vulnerability caused by improper validation of untrusted configuration fields in PDFContentScrapingStrategy, letting attackers write arbitrary files, exploit requires crafted config bodies.
- 9.8 /10 CriticalCVE-2026-91939 No auth
Cotonti Comments - Insecure Deserialization
Cotonti 1.0.0 Comments plugin contains a PHP object injection caused by passing the ci GET parameter to unserialize() without allowed_classes restriction, letting unauthenticated attackers instantiate arbitrary PHP objects to manipulate database or execute code, exploit requires crafted serialized payload.
- 7.1 /10 HighCVE-2026-91938 Auth required
Flowise - Server-Side Request Forgery
Flowise < 3.1.4 contains a server-side request forgery caused by bypassing SSRF protection in Cheerio, Playwright, and Puppeteer document loader nodes, letting attackers fetch internal and cloud metadata URLs, exploit requires attacker to provide arbitrary URLs.