Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 207 of 695
- 8.9 /10 HighCVE-2026-106155 Auth required
In Progress Telerik Report Server - Stored XSS & Privilege Escalation
In Progress Telerik Report Server < 12.2.26.1007 contains a stored XSS caused by embedding javascript: or vbscript: URLs in report navigation or HTML text box links, letting authenticated report authors execute scripts in other users' sessions, exploit requires authenticated report author.
- 7.1 /10 HighCVE-2026-106145 Auth required
In Progress Telerik Report Server - Broken Access Control
In Progress Telerik Report Server < 12.2.26.1007 contains a broken access control caused by incorrect privilege assignment in the service-agent SignalR hub, letting authenticated low-privilege users escalate privileges to access protected secrets and impersonate agents, exploit requires valid bearer token.
- 7.1 /10 HighCVE-2026-105883 Auth required
ThemeHunk Th Shop Mania - Broken Access Control
ThemeHunk Th Shop Mania <= 1.9.1 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.
- 7.2 /10 HighCVE-2026-105872 Auth required
mklacroix Product Configurator for WooCommerce - Insecure Deserialization
mklacroix Product Configurator for WooCommerce <= 1.7.5 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-105870 No auth
Delight Star Inc. WP Associate Post R2 - Reflected XSS
Delight Star Inc. WP Associate Post R2 <= 5.0.1 contains a reflected XSS caused by improper neutralization of input during web page generation, letting remote attackers execute scripts, exploit requires crafted request.
- 7.1 /10 HighCVE-2026-105318 No auth
Datasolution AcyMailing SMTP Newsletter - Reflected XSS
Datasolution AcyMailing SMTP Newsletter <= 11.1.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts via crafted input, exploit requires crafted request.
- 7.5 /10 HighCVE-2026-105281 No auth
openPDC - Information Disclosure
openPDC contains an information disclosure vulnerability caused by unauthenticated network connections to the internal data publisher, letting unauthenticated attackers retrieve complete device and measurement topology, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-105278
openPDC - Authentication Bypass
openPDC Docker image contains a broken authentication caused by fixed administrative credentials with no forced change on first use, letting attackers with network access gain full administrative control, exploit requires network access to management interface.
- 8.2 /10 HighCVE-2026-104635 No auth
elixir-protobuf protobuf - Denial of Service
elixir-protobuf protobuf >= 0.8.0 contains an uncontrolled recursion vulnerability caused by missing depth checks in Protobuf.JSON.Decode for self-referential or cyclic message types, letting unauthenticated remote attackers crash the decoding process via deeply nested JSON documents, exploit requires crafted deeply nested JSON input.
- 8.8 /10 HighCVE-2026-104629 Auth required
openPDC & openHistorian - Command Injection
openPDC and openHistorian contain a command injection caused by insecure component loading mechanism, letting authenticated attackers with file placement privileges execute arbitrary constructor code with service account privileges.
- 8.8 /10 HighCVE-2026-104392 Auth required
ExpressTech Quiz And Survey Master - Insecure Deserialization
ExpressTech Quiz And Survey Master <= 11.2.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 8.8 /10 HighCVE-2026-104084 Auth required
SmarterMail - Privilege Escalation
SmarterMail < 9777 contains a privilege escalation caused by JWT tokens embedding role claims that are not revalidated on refresh, letting attackers retain higher privileges by replaying stale tokens, exploit requires captured refresh token.
- 7.2 /10 HighCVE-2026-104082 PoC publicAuth required
SmarterMail - Remote Code Execution
SmarterMail before build 9777 contains a remote code execution caused by bypassing Volume Mount script-directory containment via domain-put endpoint, letting attackers with SysAdmin-scoped tokens execute SYSTEM-level code, exploit requires SysAdmin-scoped access token.
- 8.1 /10 HighCVE-2026-104081 Auth required
KodExplorer - Path Traversal & Stored XSS
KodExplorer < 4.55 contains a path traversal vulnerability caused by insufficient sanitization in unzip_pre_name() and lack of directory restriction in PclZip extract(), letting authenticated attackers overwrite files and execute remote code via crafted ZIP uploads.
- 8.8 /10 HighCVE-2026-103413 Auth required
Apache Camel Karavan - Broken Access Control
Apache Camel Karavan 4.0.0 to <4.22.1 contains an improper input validation vulnerability caused by unrestricted application of Kubernetes resources from unmarshalled kubernetes.yaml, letting authenticated users of any role apply arbitrary Kubernetes resources with elevated privileges, exploit requires user authentication.