Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 116 of 677

  • 8.5 /10 High
    CVE-2026-53562 Auth required

    Citrix UniconOS - Path Traversal

    Citrix UniconOS before 2607 CR and before 2603 LTSR CU2 contains a path traversal caused by improper link resolution before file access, letting attackers access unintended files, exploit requires no special privileges.

  • 8.0 /10 High
    CVE-2026-53420 Auth required

    Zoom Workplace Clients - Privilege Escalation

    Zoom Workplace Clients contain a buffer overflow in Zoom Phone feature, letting unauthenticated attackers escalate privileges via network access, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-53418 Auth required

    Zoom Workplace - Broken Access Control

    Zoom Workplace for Android < 7.2.1 contains an improper authorization vulnerability in the handler for custom URL scheme, letting unauthenticated attackers escalate privileges via network access.

  • 9.1 /10 Critical
    CVE-2026-52394 No auth

    DeepSeek - Broken Access Control

    DeepSeek V4 contains an incorrect access control vulnerability caused by crafted input, letting attackers bypass access restrictions, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-49950 No auth

    Xorbits Xoscar - Remote Code Execution

    Xorbits Xoscar <= 0.11.2 contains an insecure deserialization vulnerability caused by unvalidated data passed to cloudpickle.loads() in actor-pool TCP channel, letting remote attackers execute arbitrary code as server process, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-49785 Auth required

    Windows UEFI - Authentication Bypass

    Windows UEFI contains an improper resource shutdown or release vulnerability, letting authorized local attackers bypass security features, exploit requires local authorized access.

  • 10.0 /10 Critical
    CVE-2026-48383 No auth

    Adobe Experience Manager - Broken Access Control

    Adobe Experience Manager contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-48382 No auth

    Adobe Experience Manager - Broken Access Control

    Adobe Experience Manager contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-44415 Auth required

    Affected Systems - Broken Access Control

    Affected systems contain a broken access control vulnerability caused by improper restriction of internal APIs and paths, letting authenticated remote attackers access sensitive information and potentially delete data, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-37107 PoC publicNo auth

    HTMLy - Privilege Escalation

    HTMLy 3.1.1 contains a privilege escalation caused by improper access control in the get_feed function of admin.php, letting remote attackers escalate privileges, exploit requires remote access.

  • 7.0 /10 High
    CVE-2026-35001 No auth

    OpenS100 - Integer Overflow

    OpenS100 contains an integer overflow caused by unvalidated multiplication of grid dimension metadata in S-102 Bathymetric Surface parser, letting remote attackers trigger heap buffer overflow and execute arbitrary code, exploit requires crafted S-102 HDF5 file.

  • 8.6 /10 High
    CVE-2026-34634 No auth

    ColdFusion - Privilege Escalation

    ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 7.7 /10 High
    CVE-2026-34633 Auth required

    ColdFusion - Server-Side Request Forgery

    ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.

  • 7.2 /10 High
    CVE-2026-23707 Auth required

    Fortinet FortiAnalyzer & FortiManager - SQL Injection

    Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, 7.2 all versions, and FortiManager Cloud 7.6.2 through 7.6.4 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests, exploit requires low privileged user access.

  • 7.2 /10 High
    CVE-2026-23705 Auth required

    Fortinet FortiAnalyzer & FortiManager - SQL Injection

    Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions and FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, 7.2 all versions contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests.