Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 239 of 695

  • 8.8 /10 High
    CVE-2026-96890 Auth required

    GitHub Enterprise Server - Server-Side Request Forgery

    GitHub Enterprise Server 3.20, 3.21, and 3.22 contain a server-side request forgery caused by the secret scanning validator trusting token endpoints in committed credentials, letting authenticated repository contributors cause requests to attacker-controlled internal hosts, exploit requires authenticated user with push permission and GitHub Advanced Security enabled.

  • 7.5 /10 High
    CVE-2026-96580 No auth

    Gitea - Denial of Service

    Gitea contains a denial of service caused by unbounded expansion of static strategy.matrix in workflows, letting attackers opening fork pull requests consume server memory and terminate the process, exploit requires ability to open fork pull requests.

  • 8.1 /10 High
    CVE-2026-96404 PoC publicNo auth

    Gitea - Authentication Bypass

    Gitea contains an authentication bypass caused by the web installer issuing sessions for existing users without password verification when INSTALL_LOCK is false, letting attackers gain admin access, exploit requires installer access.

  • 7.5 /10 High
    CVE-2026-96399 No auth

    Gitea - Denial of Service

    Gitea contains a denial of service caused by invalid slice indexes from external issue tracker regex with alternating capture groups, letting users who can edit issue tracker settings crash the instance, exploit requires repository settings modification.

  • 8.1 /10 High
    CVE-2026-95594 No auth

    SMS Alert Order Notifications - Privilege Escalation

    SMS Alert Order Notifications <= 4.0.0 contains a privilege escalation vulnerability caused by unauthenticated access, letting attackers escalate privileges without authentication.

  • 7.3 /10 High
    CVE-2026-95526 No auth

    BEAR - Broken Access Control

    BEAR <= 1.2.2 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted resources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-95140 No auth

    kkFileView - Path Traversal

    kkFileView v5.0.0 through v5.0.2 contains a path traversal vulnerability caused by improper validation of the "path" parameter in FileController.java endpoints, letting unauthenticated attackers create directories and write files outside the intended root via crafted multipart requests.

  • 9.1 /10 Critical
    CVE-2026-95106 No auth

    Gitea - Path Confusion

    Gitea contains a path confusion vulnerability caused by accepting pushed Git trees with duplicate entries, letting contributors cause inconsistent file views between web and git checkout, exploit requires repository push access.

  • 8.2 /10 High
    CVE-2026-95105

    danielberkompas cloak - Reliance on Obfuscation or Encryption without Integrity Checking

    danielberkompas cloak from 0.1.0-pre onward contains a reliance on obfuscation or encryption of security-relevant inputs without integrity checking caused by use of AES-256 CTR mode encryption without MAC, letting attackers with write access to ciphertext modify decrypted plaintext via bit flipping, exploit requires write access to encrypted store.

  • 7.1 /10 High
    CVE-2026-94675 No auth

    Fluent Forms Pro Add On Pack - Reflected XSS

    Fluent Forms Pro Add On Pack <= 6.2.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-94293 No auth

    Asset Administration Shell - Broken Access Control

    Asset Administration Shell contains a broken access control vulnerability caused by unauthenticated remote attacker modifying submodel data via PATCH requests and reading data via GET endpoints, letting attackers modify and read data without authentication.

  • 9.8 /10 Critical
    CVE-2026-94205 PoC publicNo auth

    Gitea - Broken Access Control

    Gitea Actions contains a broken access control vulnerability caused by incorrect approval checks on fork pull request runs, letting attackers run fork-controlled workflow code on base repository runners without explicit approval, exploit requires Actions enabled and matching runner registered.

  • 9.6 /10 Critical
    CVE-2026-91140 No auth

    Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator - Command Injection

    Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 contains a command injection caused by shell-based temporary-file cleanup instructions, letting attackers execute arbitrary OS commands on developer machines, exploit requires crafted Swagger/OpenAPI document.

  • 8.1 /10 High
    CVE-2026-89430 Auth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by insufficient validation of push mirror remote addresses during synchronization, letting repository administrators force-push to internal or blocked Git services, exploit requires admin access to repository.

  • 7.1 /10 High
    CVE-2026-86684 PoC publicAuth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by improper permission checks in the push mirror API allowing repository administrators to push to local file system paths if the repository owner has permission, exploit requires repository administrator privileges.