Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 121 of 677
- 9.1 /10 CriticalCVE-2026-110116 No auth
Risesoft-y9 Digital-Infrastructure - Path Traversal
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability caused by crafted fullPath and fileName parameters in the fileManager storeFile endpoint, letting unauthenticated attackers write arbitrary files and potentially execute code.
- 7.5 /10 HighCVE-2026-110115 No auth
Risesoft Digital-Infrastructure - Path Traversal
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability caused by improper validation in fileManager Y9FileController.retrieveFileStream handler, letting unauthenticated attackers read arbitrary files via crafted fullPath and fileName parameters.
- 8.1 /10 HighCVE-2026-110112 No auth
Dockhand - Broken Access Control
Dockhand < 1.0.50 contains a broken access control vulnerability caused by lack of validation of OIDC iss, aud, nonce, and exp claims, letting attackers with admin rights in another tenant escalate privileges to admin, exploit requires attacker to have admin rights in another tenant.
- 7.5 /10 HighCVE-2026-110111 Auth required
Xen Orchestra - Broken Access Control
Xen Orchestra < 6.9.0 contains an improper access control vulnerability caused by unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods, letting authenticated users escalate to global administrator and execute remote code by exploiting prototype pollution via crafted .vmx files.
- 8.1 /10 HighCVE-2026-110108 Auth required
MateCloud - Broken Access Control
MateCloud through 5.0.8 contains a broken access control vulnerability caused by missing authorization in /api/v1/admin/storage endpoints in StorageController, letting authenticated low-privilege users manage object storage, exploit requires user authentication.
- 7.5 /10 HighCVE-2026-110102
Powerlevel10k - Remote Code Execution
Powerlevel10k <= 1.20.0 contains an insecure download vulnerability caused by disabled TLS certificate verification and skipped integrity checks in gitstatus/install script, letting network attackers execute malicious code as user, exploit requires network interception.
- 8.1 /10 HighCVE-2026-110097 Auth required
Ikaros - Authentication Bypass
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass caused by reuse of login temp token in jwt/apply endpoint, letting attackers with valid password skip TOTP verification and gain full account access.
- 7.1 /10 HighCVE-2026-110084 Auth required
Adobe Experience Manager - Security Feature Bypass
Adobe Experience Manager contains an xml external entity injection caused by blind XPath injection, letting low-privileged attackers bypass security features and gain unauthorized read and limited write access, exploit requires no user interaction.
- 7.1 /10 HighCVE-2026-110083 Auth required
Adobe Experience Manager - SQL Injection
Adobe Experience Manager contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers bypass security features and gain unauthorized read and limited write access, exploit requires no user interaction.
- 7.3 /10 HighCVE-2026-110025 PoC publicNo auth
Slackero phpwcms - Unrestricted File Upload
Slackero phpwcms <= 1.9.49/1.12.3 contains an unrestricted file upload vulnerability caused by manipulation of the POST_name argument in include/inc_front/content/cnt23.article.inc.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-109967 No auth
yt-dlp-web-ui - Denial of Service
yt-dlp-web-ui through 4.0.0 contains a null pointer dereference vulnerability in the Service.Formats JSON-RPC method, letting remote unauthenticated attackers crash the server by sending crafted requests with invalid url values.
- 7.1 /10 HighCVE-2026-109965 No auth
Serena - Path Traversal
Serena before 2.0.0 contains a path traversal vulnerability caused by improper symlink resolution in Project.is_path_in_project(), letting attackers read or overwrite files outside the project root, exploit requires committing symlinks inside a repository.
- 8.5 /10 HighCVE-2026-109961 Auth required
Froxlor - Authentication Bypass
Froxlor < 2.3.14 contains a newline injection vulnerability caused by unvalidated additional_members parameter in Ftps.add API, letting authenticated customers inject arbitrary entries into root-owned NSS group database, exploit requires authentication.
- 7.7 /10 HighCVE-2026-109960 Auth required
Froxlor - Stored XSS & Broken Authentication & Broken Access Control
Froxlor < 2.3.14 contains a stored cross-site scripting vulnerability caused by improper sanitization of the theme value in customer_index.php, letting authenticated customers inject scripts that execute when administrators view the customer overview, exploit requires authenticated customer access.
- 7.0 /10 HighCVE-2026-109956 No auth
NLTK - Path Traversal
NLTK through 3.10.3 contains a path traversal vulnerability caused by unvalidated model paths in WekaClassifier, letting attackers write or probe files outside allowed data roots, exploit requires control over model_filename or model argument.