Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 220 of 695

  • 7.1 /10 High
    CVE-2026-107611

    GlavSoft TightVNC Viewer - Out-of-Bounds Read

    GlavSoft TightVNC Viewer for Windows < 2.8.88 contains an out-of-bounds read vulnerability caused by improper validation of palette indices in the ZRLE decoder, letting malicious VNC servers read heap memory and crash the viewer remotely, exploit requires a malicious or compromised VNC server.

  • 7.5 /10 High
    CVE-2026-107589 Auth required

    Jacamar CI - Authentication Bypass

    Jacamar CI < 0.30.0 contains an authentication bypass caused by insufficient job validation for service accounts, letting authenticated CI users generate arbitrary account names, exploit requires user authentication.

  • 7.4 /10 High
    CVE-2026-107584

    Progressive Robot hMailServer - Man-in-the-Middle

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a misconfiguration in DANE implementation caused by improper DNSSEC validation in the DNS resolver, letting attackers on the DNS or SMTP path disable DANE and intercept or modify emails, exploit requires attacker to control or manipulate DNS responses and be active on SMTP path.

  • 7.5 /10 High
    CVE-2026-107579 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a denial of service caused by inefficient algorithmic complexity in bounce and complaint processing, letting remote unauthenticated attackers stop mail delivery by sending crafted messages, exploit requires bounce or complaint processing enabled or mailing list managed.

  • 7.5 /10 High
    CVE-2026-107577 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a denial of service caused by inefficient algorithmic complexity and a non-terminating loop in MIME processing, letting remote unauthenticated attackers make mail services unavailable by sending crafted messages, exploit requires sending specially crafted MIME headers.

  • 7.5 /10 High
    CVE-2026-107576 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a denial of service vulnerability caused by inefficient algorithmic complexity in inbound DKIM and ARC signature verification, letting remote unauthenticated attackers make mail services unavailable by sending crafted messages.

  • 7.5 /10 High
    CVE-2026-107574 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer contains a denial of service caused by inefficient algorithmic complexity in the JSON reader, letting remote unauthenticated attackers make mail services unavailable by sending crafted large JSON objects, exploit requires sending large crafted TLS-RPT reports or JSON bodies.

  • 7.8 /10 High
    CVE-2026-107573 Auth required

    Progressive Robot hMailServer - Broken Access Control

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains an information disclosure vulnerability caused by incorrect default permissions on installer-created files and folders, letting local authenticated users read sensitive mail server data, exploit requires local user access.

  • 9.1 /10 Critical
    CVE-2026-107510 Auth required

    Unspecified Product - Privilege Escalation

    An unspecified product contains a privilege escalation caused by injection of arguments in troubleshooting commands, letting authenticated high privilege users escalate their privileges.

  • 7.1 /10 High
    CVE-2026-107503 No auth

    Eclipse Ditto Ditto Explorer - Authentication Bypass

    Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] contains an OAuth authorization code and PKCE verifier theft vulnerability caused by unvalidated environment URLs allowing injected OIDC authority, letting attackers take over accounts by redeeming tokens, exploit requires crafted link with attacker-controlled OIDC authority and autoSso enabled.

  • 9.8 /10 Critical
    CVE-2026-107459 No auth

    Openfind SecuShare Pro - Command Injection

    Openfind SecuShare Pro contains an OS command injection caused by improper input sanitization, letting unauthenticated remote attackers execute arbitrary OS commands on the server, exploit requires no authentication.

  • 9.5 /10 Critical
    CVE-2026-107406 PoC public

    Citrix NetScaler ADC - Remote Code Execution & Denial of Service

    Citrix NetScaler ADC and NetScaler Gateway in specified versions contain a memory overflow vulnerability caused by improper handling in SAML SP or IdP configurations, letting attackers cause remote code execution or denial of service, exploit requires SAML SP or IdP configuration.

  • 7.4 /10 High
    CVE-2026-107385

    MariaDB Connector/Node.js - SQL Injection

    MariaDB Connector/Node.js < 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contains a SQL injection caused by improper text-protocol escaping that ignores NO_BACKSLASH_ESCAPES mode, letting attackers inject arbitrary SQL with database privileges, exploit requires vulnerable sql_mode enabled.

  • 8.1 /10 High
    CVE-2026-107384 No auth

    MariaDB Connector/Node.js - SQL Injection

    MariaDB Connector/Node.js 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contains a SQL injection caused by unescaped keys in permitSetMultiParamEntries option expanding into SQL SET clause, letting attackers execute arbitrary SQL with database user privileges, exploit requires permitSetMultiParamEntries enabled.

  • 7.5 /10 High
    CVE-2026-107383 No auth

    MariaDB Connector/Node.js - Information Disclosure

    MariaDB Connector/Node.js < 3.2.5, < 3.3.4, < 3.4.7, and < 3.5.4 contains an information disclosure caused by improper validation of GeoJSON Polygon and MultiPolygon rings in binary encoders, letting attackers disclose uninitialized Node.js heap data via database values, exploit requires sending malformed non-array rings.