Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 128 of 677

  • 7.5 /10 High
    CVE-2026-106623 No auth

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability caused by improper access control, letting attackers disclose sensitive memory information, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-106622 No auth

    ColdFusion - Server-Side Request Forgery

    ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-106621 No auth

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.6 /10 Critical
    CVE-2026-106620 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability caused by flawed access control, letting low-privileged attackers bypass security measures and gain unauthorized write access, exploit requires no user interaction.

  • 9.0 /10 Critical
    CVE-2026-106619 No auth

    ColdFusion - Improper Input Validation

    ColdFusion contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.

  • 8.8 /10 High
    CVE-2026-106618 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-106617 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 8.6 /10 High
    CVE-2026-106616 No auth

    ColdFusion - XML External Entity Injection

    ColdFusion contains an XML External Entity Injection (XXE) vulnerability caused by improper restriction of XML external entity references, letting attackers read arbitrary files, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-106615 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-106614 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.

  • 8.8 /10 High
    CVE-2026-106613 Auth required

    ColdFusion - Remote Code Execution

    ColdFusion contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-106612 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-106173 No auth

    Fortinet FortiSIEM - Path Traversal

    Fortinet FortiSIEM 7.5.0 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers execute unauthorized code or commands via specially crafted packets, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-106090 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-106089 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.