Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 574 of 677
- 7.7 /10 HighCVE-2026-90769 Auth required
Open Notebook - Server Side Request Forgery
Open Notebook < 1.11.0 contains a server side request forgery caused by improper validation of URL parameter in POST /api/sources endpoint, letting authenticated users perform requests to internal services.
- 8.1 /10 HighCVE-2026-90768 Auth required
CAPEv2 - Broken Access Control
CAPEv2 through commit 471ee4b contains a broken access control caused by failure to validate task ownership in REST API endpoints, letting authenticated users read and delete analyses of other users, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-90678 No auth
HAProxy - HTTP Request Smuggling
HAProxy 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5 contain an HTTP request smuggling vulnerability caused by improper handling of HTTP/3 DATA frame lengths in chunked transfer coding on reused HTTP/1.1 backend connections, letting remote unauthenticated clients smuggle requests past frontend rules, exploit requires HTTP/3 frontend with QUIC support and specific backend conditions.
- 7.5 /10 HighCVE-2026-90668
UnrealIRCd - Denial of Service
UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 contains a denial of service caused by unlimited HTTP request headers in the webserver when websocket or JSON-RPC listener is enabled, letting remote attackers cause memory exhaustion and server unresponsiveness, exploit requires enabled websocket or JSON-RPC listener.
- 8.1 /10 HighCVE-2026-90651
Socket Firewall - Man-in-the-Middle
Socket Firewall before 2.0.0 contains a man-in-the-middle vulnerability caused by disabled TLS certificate verification in default configuration, letting attackers intercept and modify traffic between the firewall and upstream services, exploit requires attacker to intercept network traffic.
- 7.3 /10 HighCVE-2026-90603 No auth
Anil-matcha Open-Generative-AI - Unrestricted File Upload
Anil-matcha Open-Generative-AI <= 1.0.11/2.0.0 contains an unrestricted file upload caused by manipulation of the "x-proxy-target-url" argument in /api/upload-binary S3 Upload component, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-90601 No auth
getzep graphiti - Authentication Bypass
getzep graphiti <= 0.30.2 contains an authentication bypass caused by improper authentication in REST API component, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.3 /10 HighCVE-2026-90593 No auth
embedded-graphics - Integer Overflow
embedded-graphics <= 0.8.2 contains an integer overflow caused by manipulation of the "width" argument in ImageRaw::draw_sub_image function, letting remote attackers cause memory corruption or crash, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-90579 No auth
cheshire-cat-ai Cheshire Cat AI - Authentication Bypass
cheshire-cat-ai Cheshire Cat AI <= 1.9.2 contains an authentication bypass caused by manipulation of the user_id argument in _authorize_http_key function, letting remote attackers bypass authentication, exploit requires crafted user_id input.
- 7.3 /10 HighCVE-2026-90566 No auth
Rizwan17 inventory-management-system - Authorization Bypass
Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f contains an authorization bypass caused by manipulation of the "usertype" argument in createUserAccount function of register.php, letting remote attackers gain improper authorization, exploit requires crafted request.
- 8.1 /10 HighCVE-2026-90562 No auth
LangBot - Authentication Bypass
LangBot < 4.10.11 contains a broken authentication caused by weak password recovery keys with 24 bits entropy and no rate limiting on reset-password endpoint, letting remote attackers exhaust keyspace and gain admin access, exploit requires knowing admin email.
- 8.7 /10 HighCVE-2026-90561 Auth required
Strapi - Stored XSS
Strapi 4.x < 4.26.3 and 5.x < 5.48.1 contain a stored XSS caused by failure to strip script tags in content manager WYSIWYG preview, letting Author-role users execute scripts in Editor or Super Admin sessions, exploit requires Author-role access.
- 7.3 /10 HighCVE-2026-90526 No auth
SourceCodester School Registration and Fee System - SQL Injection
SourceCodester School Registration and Fee System 1.0 contains a SQL injection caused by manipulation of the "Category" argument in /bilal/save_class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90524 No auth
jaychouchannel Tourism-Management-System - Authentication Bypass
jaychouchannel Tourism-Management-System contains an authentication bypass caused by manipulation in Update Endpoint, letting remote attackers bypass authentication, exploit requires no special conditions.
- 7.3 /10 HighCVE-2026-90523 No auth
jaychouchannel Tourism-Management-System - Broken Access Control
jaychouchannel Tourism-Management-System contains an improper privilege management vulnerability caused by manipulation of the UsersEntity argument in User Register Endpoint, letting remote attackers escalate privileges, exploit requires crafted input.