Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 127 of 677

  • 7.6 /10 High
    CVE-2026-108179 Auth required

    PluginUs.Net WOLF - SQL Injection

    PluginUs.Net WOLF <= 1.1.1 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.

  • 7.8 /10 High
    CVE-2026-108136 Auth required

    Microsoft Windows Search Component - Privilege Escalation

    Microsoft Windows Search Component contains a use after free vulnerability allowing authorized local attackers to elevate privileges by exploiting memory management flaws.

  • 7.0 /10 High
    CVE-2026-108135 Auth required

    Windows Backup Engine - Privilege Escalation

    Windows Backup Engine contains a broken access control vulnerability caused by improper link resolution before file access, letting authorized attackers locally elevate privileges, exploit requires local access with authorization.

  • 7.0 /10 High
    CVE-2026-108134 Auth required

    Windows Autopilot - Privilege Escalation

    Windows Autopilot contains a use after free vulnerability that allows an authorized attacker to elevate privileges locally, exploit requires attacker to be authorized.

  • 7.8 /10 High
    CVE-2026-108133 Auth required

    Windows Modern Device Management - Privilege Escalation

    Windows Modern Device Management contains a privilege escalation caused by release of invalid pointer or reference, letting authorized attackers elevate privileges locally, exploit requires attacker authorization.

  • 7.0 /10 High
    CVE-2026-108132 Auth required

    Windows Kerberos - Privilege Escalation

    Windows Kerberos contains a double free vulnerability caused by improper memory management, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 7.5 /10 High
    CVE-2026-108131 No auth

    Active Directory Federation Services - Authentication Bypass

    Active Directory Federation Services (AD FS) contains a spoofing vulnerability caused by insufficient authentication validation, letting unauthorized attackers perform network spoofing, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-108130 Auth required

    Windows Virtualization-Based Security Enclave - Privilege Escalation

    Windows Virtualization-Based Security (VBS) Enclave contains a heap-based buffer overflow, letting authorized local attackers elevate privileges, exploit requires local access with authorization.

  • 7.7 /10 High
    CVE-2026-106634 Auth required

    Adobe Experience Manager - Path Traversal

    Adobe Experience Manager contains a path traversal caused by improper limitation of pathname to restricted directory, letting low-privileged attackers write arbitrary files to unauthorized locations, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-106630 No auth

    Adobe Experience Manager - Stored XSS

    Adobe Experience Manager contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.3 /10 Critical
    CVE-2026-106629 No auth

    Adobe Experience Manager - Stored XSS

    Adobe Experience Manager contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 7.5 /10 High
    CVE-2026-106627 No auth

    CAI Content Credentials - Denial of Service

    CAI Content Credentials contains an uncontrolled resource consumption vulnerability caused by improper resource management, letting attackers cause application denial-of-service, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-106626 Auth required

    Adobe Experience Manager - Remote Code Execution

    Adobe Experience Manager contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.

  • 7.8 /10 High
    CVE-2026-106625 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 10.0 /10 Critical
    CVE-2026-106624 No auth

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.