Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 129 of 677

  • 7.7 /10 High
    CVE-2026-106047 Auth required

    Ivanti Xtraction - Path Traversal

    Ivanti Xtraction < 2026.4 contains a path traversal caused by improper validation in the template export functionality, letting remote authenticated attackers read arbitrary files.

  • 7.5 /10 High
    CVE-2026-106043 No auth

    Ivanti Xtraction - Broken Access Control

    Ivanti Xtraction < 2026.4 contains a missing authentication for critical function caused by lack of authentication in trusted site management, letting remote unauthenticated attackers create or modify trusted sites, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-106042 Auth required

    Ivanti Xtraction - Broken Access Control

    Ivanti Xtraction < 2026.4 contains an external control of file name or path vulnerability caused by improper validation of application-generated request destinations, letting remote authenticated attackers redirect requests and obtain EPMM connector credentials.

  • 7.7 /10 High
    CVE-2026-105994 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability caused by flawed access control, letting low-privileged attackers bypass security features and gain unauthorized write access, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-105903 Auth required

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-105902 No auth

    CAI Content Credentials - Denial of Service

    CAI Content Credentials contains an uncontrolled resource consumption vulnerability caused by improper resource management, letting attackers cause application denial-of-service, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-105901 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 7.5 /10 High
    CVE-2026-105900 No auth

    ColdFusion - Denial of Service

    ColdFusion contains an improper input validation vulnerability that allows attackers to cause application denial-of-service by crashing the application, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-105899 No auth

    ColdFusion - Unrestricted File Upload

    ColdFusion contains an unrestricted file upload vulnerability allowing dangerous file types, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 8.2 /10 High
    CVE-2026-105898 Auth required

    ColdFusion - Authentication Bypass

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, requiring victim to open a malicious file.

  • 8.6 /10 High
    CVE-2026-105897 No auth

    ColdFusion - Privilege Escalation

    ColdFusion contains a server-side request forgery caused by improper request validation, letting attackers escalate privileges, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-105895 Auth required

    Adobe Experience Manager - Improper Input Validation

    Adobe Experience Manager contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.

  • 8.8 /10 High
    CVE-2026-105733 Auth required

    Windows Hyper-V - Broken Access Control

    Windows Hyper-V contains an improper access control vulnerability allowing authorized attackers to execute code locally, exploit requires attacker to have local authorization.

  • 7.3 /10 High
    CVE-2026-105732 Auth required

    SysInternals - Privilege Escalation

    SysInternals contains a stack-based buffer overflow allowing authorized local attackers to elevate privileges, exploit requires local access with authorization.

  • 7.1 /10 High
    CVE-2026-105729 Auth required

    SysInternals - Privilege Escalation

    SysInternals contains a pointer dereference vulnerability caused by untrusted pointer dereference, letting authorized local attackers elevate privileges, exploit requires local access with authorization.