Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 233 of 695
- 9.3 /10 CriticalCVE-2026-107103 No auth
ERP system - SQL Injection
ERP system contains a SQL injection caused by insufficient validation and parameterization of user input in an API endpoint, letting unauthenticated remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-107102 No auth
ERP system - Authentication Bypass
ERP system contains an authentication bypass caused by improper validation of payment callback parameters and inadequate authentication controls in API endpoint, letting unauthenticated remote attackers gain unauthorized access to user accounts, exploit requires crafted parameter manipulation.
- 7.1 /10 HighCVE-2026-106560 Auth required
Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown - Path Traversal
Backstage @backstage/plugin-scaffolder-backend-module-confluence-to-markdown < 0.3.25 contains a path traversal caused by improper repository path validation in scaffolder backend module, letting authenticated users write generated content outside task workspace, exploit requires authentication and template execution.
- 8.8 /10 HighCVE-2026-106558 Auth required
Backstage - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.8, < 1.15.6, and < 2.0.1 contains a remote code execution caused by improper validation of mapping-style markdown_extensions configuration, letting authenticated attackers bypass sanitization and execute arbitrary code during documentation generation, exploit requires attacker to register or influence SCM-backed documentation source.
- 7.7 /10 HighCVE-2026-106557 Auth required
Backstage @backstage/plugin-techdocs-node - Broken Access Control
Backstage @backstage/plugin-techdocs-node < 1.14.6 and < 1.15.4 contains an information disclosure caused by insufficient validation of TechDocs Markdown extension configuration, letting authenticated users access resources outside intended documentation boundaries, exploit requires authenticated user with documentation source modification privileges.
- 7.7 /10 HighCVE-2026-106556 Auth required
Backstage @backstage/plugin-techdocs-node - Command Injection
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a command injection caused by insufficient validation of MkDocs configuration in techdocs mkdocs.yml sanitization, letting authenticated users who can register or modify documentation sources execute arbitrary commands in the build environment.
- 7.7 /10 HighCVE-2026-106510 Auth required
Backstage @backstage/plugin-techdocs-node - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a remote code execution caused by crafted markdown_extensions in techdocs mkdocs.yml, letting authenticated users who can register catalog entities execute arbitrary OS commands on the TechDocs build host, exploit requires authenticated user with catalog entity registration rights.
- 8.1 /10 HighCVE-2026-106471 Auth required
Candlepin - Broken Access Control
Candlepin contains a broken access control caused by incorrect authorization filter logic in @Verify-annotated parameters, letting low-privilege authenticated attackers bypass authorization to disclose and modify subscription data.
- 7.3 /10 HighCVE-2026-106164 No auth
In Progress Telerik Document Processing - Denial of Service
In Progress Telerik Document Processing SpreadProcessing library < 2026.3.1006 contains a denial of service caused by infinite loop when importing a specifically corrupted XLS file, letting attackers cause unresponsive CPU thread, exploit requires crafted XLS file.
- 8.8 /10 HighCVE-2026-106059 No auth
GitAhead - Command Injection
GitAhead through 2.7.1 on macOS contains a command injection caused by unescaped repository filenames interpolated into Show in Finder AppleScript, letting attackers execute shell commands as the victim user, exploit requires crafted repository filenames.
- 7.5 /10 HighCVE-2026-106058 No auth
GitAhead - Command Injection
GitAhead through 2.7.1 contains a command injection caused by crafted filenames substituted into clean/smudge filter commands in src/git/Filter.cpp, letting attackers execute arbitrary OS commands during checkout or staging, exploit requires malicious repository with crafted filenames.
- 7.8 /10 HighCVE-2026-106057 No auth
patool - Command Injection
patool before 4.0.6 contains a command injection caused by shell_quote_nt failing to escape cmd.exe metacharacters or embedded double quotes in archive filenames on Windows, letting attackers execute arbitrary commands with patool process privileges, exploit requires crafted archive filenames.
- 7.5 /10 HighCVE-2026-106056 Auth required
Rundeck - Command Injection
Rundeck < 6.2.0 contains a command injection caused by improper sanitization of option values in Windows node execution, letting authenticated users with job run permission execute arbitrary OS commands.
- 8.0 /10 HighCVE-2026-105816 Auth required
Vault - Remote Code Execution
Vault and Vault Enterprise < 2.1.2, 1.21.12, 1.20.17, 1.19.23 contain a remote code execution caused by improper verification of plugin catalog entries referencing binaries outside the configured plugin directory, letting privileged operators executing arbitrary code on the Vault host, exploit requires privileged operator restoring an Integrated Storage snapshot.
- 9.2 /10 CriticalCVE-2026-105324 No auth
ADM - HTTP Header Injection
ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21 contain an HTTP header injection caused by crafted HTTP requests with injected headers via the state parameter in start-page-loader.cgi, letting unauthenticated remote attackers read arbitrary files using X-Sendfile.