Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 770 of 891
- 9.9 /10 CriticalCVE-2026-90937 Auth required
Froxlor - Broken Access Control
Froxlor < 2.2.5 contains a configuration injection vulnerability caused by failure to validate newline characters in subdomain redirect URLs, letting authenticated customers inject arbitrary web server directives, exploit requires authentication.
- 7.1 /10 HighCVE-2026-90933 Auth required
Laradashboard - Broken Access Control
Laradashboard through 1.2.2 contains a broken access control vulnerability in Local License API endpoints, letting authenticated low-privileged users read, overwrite, and delete premium module license keys, exploit requires authentication.
- 7.2 /10 HighCVE-2026-90932 Auth required
LaraDashboard - Path Traversal
LaraDashboard 0.9.7 through 1.2.2 contain a path traversal vulnerability caused by improper validation of backup_file/filename in core-upgrade backup handling, letting authenticated users with delegated settings.edit permission delete or write arbitrary files, exploit requires delegated settings.edit permission.
- 8.1 /10 HighCVE-2026-90929 Auth required
File Browser - Broken Access Control
File Browser >= 2.5.0 and <= 2.63.23 contains an incorrect authorization flaw in the direct-upload endpoint caused by improper permission checks during cleanup, letting authenticated non-admin users delete unauthorized directories within their scope, exploit requires authenticated user with Create and Modify permissions.
- 9.8 /10 CriticalCVE-2026-90919
LightLLM - Remote Code Execution
LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated /visual_register WebSocket endpoint passing client frames directly to pickle.loads(), letting attackers execute arbitrary code with Config Server privileges, exploit requires access to Config Server port.
- 9.8 /10 CriticalCVE-2026-90898 PoC publicNo auth
Bifrost transports - Command Injection
Bifrost transports v2.0.0 contains a command injection caused by unauthenticated stdio client registration via POST /api/mcp/client, letting unauthenticated attackers execute arbitrary programs as the Bifrost process user, exploit requires authentication disabled.
- 7.8 /10 HighCVE-2026-90894 Auth required
Parallels Desktop - Command Injection
Parallels Desktop contains a command injection caused by improper handling of quoted folder names in PrlSrv_InstallAppliance, letting local attackers execute arbitrary commands as root via crafted appliance folder names, exploit requires local access.
- 7.3 /10 HighCVE-2026-90819 No auth
a2aproject a2a-java - HTTP Response Splitting
a2aproject a2a-java 1.2.0 contains an HTTP response splitting vulnerability caused by improper Authorization Header Construction in BasePushNotificationSender.dispatchNotification, letting remote attackers manipulate HTTP responses, exploit requires crafted requests.
- 7.3 /10 HighCVE-2026-90809 No auth
HKUDS nanobot - Command Injection
HKUDS nanobot <= 0.2.1 contains a command injection caused by improper handling in ExecTool._guard_command and ExecTool._spawn in nanobot/agent/tools/shell.py, letting remote attackers inject arguments, exploit requires remote access.
- 7.3 /10 HighCVE-2026-90805 No auth
subhajitkhan online-clinic-management-system - SQL Injection
subhajitkhan online-clinic-management-system contains a SQL injection caused by manipulation of the doc_mail/doc_pswd arguments in doctorlogin.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-90789 No auth
itsourcecode Leave Management System - SQL Injection
itsourcecode Leave Management System 1.0 contains a sql injection caused by manipulation of the "user_email" argument in /login.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90787 No auth
Soarkey StudentManagement - Broken Access Control
Soarkey StudentManagement contains an improper privilege management vulnerability caused by manipulation of the "level" argument in RegisterServlet.doPost of Registration Workflow, letting remote attackers escalate privileges, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-90715 No auth
marcobambini Gravity - Integer Overflow
marcobambini Gravity <= 0.9.7 contains an integer overflow caused by improper handling in udp json-parser component in src/utils/gravity_json.c, letting remote attackers cause potential memory corruption, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-90710 No auth
taisan tarzan-cms - Server-Side Request Forgery
taisan tarzan-cms 1.0.0 contains a server-side request forgery caused by manipulation of the "httpUrl" argument in Theme Download Function, letting remote attackers make arbitrary server requests, exploit requires no special privileges.
- 7.3 /10 HighCVE-2026-90708 No auth
Yot CMS - SQL Injection
Yot CMS <= 3.3.1 contains a SQL injection caused by manipulation of the yot3_user/yot3_pass arguments in the Login function of global.php Cookie Handler, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.