Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 133 of 677

  • 8.8 /10 High
    CVE-2026-104085 Auth required

    SPIP odt2spip - Command Injection

    odt2spip plugin for SPIP < 4.4.0 contains a command injection caused by insufficient sanitization of filenames in document import, letting authenticated authors execute arbitrary OS commands as the web-server user.

  • 7.8 /10 High
    CVE-2026-103967 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-103966 No auth

    Adobe Framemaker - Remote Code Execution

    Adobe Framemaker contains a heap-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 8.7 /10 High
    CVE-2026-103937 No auth

    Misskey - Denial of Service

    Misskey 13.0.0 to 2025.4.1 and 2025.5.0 to 2026.7.0 contains a denial of service caused by missing cleanup during file uploads, letting attackers exhaust storage or file descriptors, exploit requires repeated file uploads.

  • 9.3 /10 Critical
    CVE-2026-103928 No auth

    Metabase - File System Read & Write

    Metabase 1.55.0 to 1.58.16, 1.59.13, 1.60.9, and 1.61.4 contains a file system read and write vulnerability caused by unrestricted host-facing built-in functions in native queries against H2 data source, letting authorized users read or write arbitrary files on the server, exploit requires user authorization to run native queries.

  • 7.8 /10 High
    CVE-2026-103854 No auth

    Dimension - Buffer Overflow

    Dimension contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-103851 No auth

    Substance3D Stager - Buffer Overflow

    Substance3D Stager contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 10.0 /10 Critical
    CVE-2026-103849 No auth

    Adobe Commerce - Template Injection

    Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-103848 Auth required

    Adobe Experience Manager - OS Command Injection

    Adobe Experience Manager contains an OS command injection caused by improper neutralization of special elements, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 8.6 /10 High
    CVE-2026-103847 No auth

    Dimension - Remote Code Execution

    Dimension contains an untrusted search path vulnerability caused by improper handling of executable search paths, letting local attackers with user permissions execute arbitrary code, exploit requires victim to run the application.

  • 8.6 /10 High
    CVE-2026-103846 No auth

    Dimension - Stored XSS

    Dimension contains an improper neutralization of input during web page generation, letting local attackers with user permissions execute arbitrary code, exploit requires victim to run the application.

  • 8.6 /10 High
    CVE-2026-103845 No auth

    Dimension - Remote Code Execution

    Dimension contains an uncontrolled search path element vulnerability that allows a local attacker with user permissions to execute arbitrary code by tricking a victim into running the application, exploit requires user interaction.

  • 7.8 /10 High
    CVE-2026-103844 No auth

    Dimension - Remote Code Execution

    Dimension contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-103843 No auth

    Substance3D Stager - Use After Free

    Substance3D - Stager contains a use after free vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-103842 No auth

    Substance3D Stager - Remote Code Execution

    Substance3D Stager contains an out-of-bounds read caused by parsing crafted files, letting attackers execute code in the context of the current user, exploit requires victim to open a malicious file.