Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 154 of 681
- 7.8 /10 HighCVE-2026-18390 No auth
Ministry of Justice General Directorate of Information Technology UYAP Document Editor - OS Command Injection
Ministry of Justice General Directorate of Information Technology UYAP Document Editor < 5.4.20 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.
- 7.7 /10 HighCVE-2026-18166 Auth required
IBM Db2 - Information Disclosure
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows contains an information disclosure vulnerability caused by improper authorization in the CREATE WRAPPER command, letting remote authenticated attackers obtain sensitive information.
- 7.1 /10 HighCVE-2026-17475 Auth required
IBM Planning Analytics - Broken Access Control
IBM Planning Analytics 2.0 and 2.1 contain a broken access control caused by improper functional level access control, letting remote authenticated attackers delete folders and applications of other users, exploit requires authentication.
- 8.8 /10 HighCVE-2026-12613 No auth
Ministry of Justice General Directorate of Information Technology UYAP Document Editor - Insecure Deserialization
Ministry of Justice General Directorate of Information Technology UYAP Document Editor < 5.4.20 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-109673 Auth required
Frappe ERPNext - Stored XSS
Frappe ERPNext < 15.103.0 and 16.x < 16.12.0 contains a stored XSS caused by improper neutralization of record names in dashboards, tools, and portals, letting authenticated attackers execute scripts in other users' browsers.
- 7.3 /10 HighCVE-2026-109671 Auth required
Frappe ERPNext - Stored XSS
Frappe ERPNext < 15.113.0 and 16.x < 16.24.0 contains a stored XSS caused by unescaped profile field rendering in portal pages, letting low-privilege attackers execute scripts in administrator browsers, exploit requires low-privilege access.
- 8.8 /10 HighCVE-2026-109667 Auth required
Frappe ERPNext - Privilege Escalation
Frappe ERPNext < 15.111.0 and 16.x < 16.22.0 contains a privilege escalation caused by disabled permission checks in a record-creation endpoint, letting authenticated users create privileged accounts and take full control, exploit requires authentication.
- 7.3 /10 HighCVE-2026-109653 Auth required
Frappe ERPNext - Stored XSS
Frappe ERPNext < 15.119.0 and 16.x < 16.31.0 contains a stored XSS caused by unescaped record fields rendered in HTML attribute context, letting low-privilege users execute scripts in privileged users' browsers, exploit requires low-privilege user access.
- 8.8 /10 HighCVE-2026-109652 Auth required
Frappe ERPNext - Server-Side Template Injection
Frappe ERPNext < 15.119.1 and 16.x < 16.32.0 contains a server-side template injection caused by unvalidated user-controlled message fields in template rendering, letting authenticated attackers with common operational roles execute arbitrary template expressions to read/write database data, delete documents, send outbound requests, and send mail.
- 8.1 /10 HighCVE-2026-109640 Auth required
Frappe ERPNext - Broken Access Control
Frappe ERPNext < 16.22.0 contains a broken access control vulnerability caused by missing authorization checks in certain endpoints, letting authenticated users modify records beyond their permitted roles.
- 8.1 /10 HighCVE-2026-109633 No auth
Frappe ERPNext - Stored XSS
Frappe ERPNext < 15.119.1 and 16.x < 16.32.0 contains a stored XSS caused by unneutralized content submitted through a public booking page, letting unauthenticated attackers execute scripts in privileged user sessions.
- 7.1 /10 HighCVE-2026-109617 Auth required
Frappe ERPNext - Broken Access Control
Frappe ERPNext < 15.121.0 and 16.x < 16.34.0 contains a broken access control vulnerability caused by missing authorization checks in certain endpoints during document creation, letting authenticated low-privileged users bypass role-based permissions to create unauthorized documents.
- 7.1 /10 HighCVE-2026-109616 Auth required
Frappe ERPNext - Broken Access Control
Frappe ERPNext < 15.121.3 and 16.x < 16.35.0 contains a broken access control vulnerability caused by missing authorization checks in certain endpoints, letting authenticated users modify data beyond their role permissions.
- 7.1 /10 HighCVE-2026-109613 Auth required
Frappe ERPNext - Broken Access Control
Frappe ERPNext < 15.121.0 and 16.x < 16.34.0 contains a broken access control vulnerability caused by missing authorization checks on document status modification endpoints, letting authenticated low-privileged users modify data beyond their roles, exploit requires authentication with low privileges.
- 7.3 /10 HighCVE-2026-109612 Auth required
Frappe ERPNext - Stored XSS
Frappe ERPNext < 15.120.0 and 16.x < 16.33.0 contains a stored XSS caused by unescaped interpolation of stored record names in report view, letting authenticated users execute scripts in other users' sessions, exploit requires authenticated user to create records.