Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 555 of 677
- 7.8 /10 HighCVE-2026-90948 No auth
GIMP - Remote Code Execution
GIMP contains a heap-based buffer overflow caused by an integer overflow in ICO file loader during buffer size calculation for embedded PNG images, letting remote attackers execute arbitrary code or cause a crash, exploit requires opening a crafted ICO file.
- 7.8 /10 HighCVE-2026-90947 No auth
GIMP - Remote Code Execution
GIMP contains a buffer overflow caused by improper validation of the number of light sources in a specially crafted lighting preset file, letting attackers execute arbitrary code by convincing users to open malicious files.
- 7.5 /10 HighCVE-2026-90946 No auth
DeepWiki-Open - Arbitrary File Read
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability caused by lack of path containment in the unauthenticated /ws/chat WebSocket endpoint, letting attackers read sensitive files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-90945 No auth
Crawlab - Authentication Bypass
Crawlab <= 0.6.3 contains a broken authentication caused by hard-coded HMAC-SHA256 secret for JWT token signing, letting unauthenticated attackers forge admin tokens to access APIs and execute code on worker nodes, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-90944 No auth
Krayin CRM - Authentication Bypass
Krayin CRM <= 2.2.6 contains an authentication bypass caused by unauthenticated access to the POST /admin/mail/inbound-parse endpoint, letting unauthenticated attackers inject arbitrary emails into the CRM inbox, exploit requires no authentication.
- 8.7 /10 HighCVE-2026-90943 Auth required
Parallax filament-comments - Stored XSS
Parallax filament-comments <= 3.0.0 contains a stored XSS caused by improper sanitization in comment body rendering, letting authenticated panel users inject malicious scripts that execute in other users' browsers.
- 9.6 /10 CriticalCVE-2026-90942 Auth required
Casdoor - Authentication Bypass
Casdoor through 4.4.0 contains an information disclosure caused by improper masking of the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, letting organization administrators retrieve the private key, exploit requires organization administrator privileges.
- 8.6 /10 HighCVE-2026-90938 No auth
LangBot langbot_plugin - Authentication Bypass
LangBot langbot_plugin <= 0.4.17 contains an authentication bypass caused by default empty plugin_debug_key on debug WebSocket server, letting remote attackers register debug plugins and access sensitive IM events, exploit requires network access to port 5401.
- 9.9 /10 CriticalCVE-2026-90937 Auth required
Froxlor - Broken Access Control
Froxlor < 2.2.5 contains a configuration injection vulnerability caused by failure to validate newline characters in subdomain redirect URLs, letting authenticated customers inject arbitrary web server directives, exploit requires authentication.
- 7.1 /10 HighCVE-2026-90933 Auth required
Laradashboard - Broken Access Control
Laradashboard through 1.2.2 contains a broken access control vulnerability in Local License API endpoints, letting authenticated low-privileged users read, overwrite, and delete premium module license keys, exploit requires authentication.
- 7.2 /10 HighCVE-2026-90932 Auth required
LaraDashboard - Path Traversal
LaraDashboard 0.9.7 through 1.2.2 contain a path traversal vulnerability caused by improper validation of backup_file/filename in core-upgrade backup handling, letting authenticated users with delegated settings.edit permission delete or write arbitrary files, exploit requires delegated settings.edit permission.
- 8.1 /10 HighCVE-2026-90929 Auth required
File Browser - Broken Access Control
File Browser >= 2.5.0 and <= 2.63.23 contains an incorrect authorization flaw in the direct-upload endpoint caused by improper permission checks during cleanup, letting authenticated non-admin users delete unauthorized directories within their scope, exploit requires authenticated user with Create and Modify permissions.
- 9.8 /10 CriticalCVE-2026-90919
LightLLM - Remote Code Execution
LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated /visual_register WebSocket endpoint passing client frames directly to pickle.loads(), letting attackers execute arbitrary code with Config Server privileges, exploit requires access to Config Server port.
- 9.8 /10 CriticalCVE-2026-90898 PoC publicNo auth
Bifrost transports - Command Injection
Bifrost transports v2.0.0 contains a command injection caused by unauthenticated stdio client registration via POST /api/mcp/client, letting unauthenticated attackers execute arbitrary programs as the Bifrost process user, exploit requires authentication disabled.
- 7.8 /10 HighCVE-2026-90894 Auth required
Parallels Desktop - Command Injection
Parallels Desktop contains a command injection caused by improper handling of quoted folder names in PrlSrv_InstallAppliance, letting local attackers execute arbitrary commands as root via crafted appliance folder names, exploit requires local access.