Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 277 of 695

  • 8.4 /10 High
    CVE-2026-104809

    DigitalCanion Mitel Linux - Remote Code Execution

    DigitalCanion Mitel Linux virtual machine contains a command injection caused by loading an attacker-controlled .so file due to predictable module naming without integrity verification, letting attackers execute arbitrary code with privileged process context, exploit requires attacker to place malicious shared object with expected name.

  • 8.5 /10 High
    CVE-2026-104805

    DigitalCanion Backup - Unrestricted File Upload

    DigitalCanion backup restoration functionality contains an unrestricted file upload caused by improper validation of restored TGZ archive files, letting attackers with repository access place arbitrary files, potentially leading to root code execution, exploit requires access to backup repository.

  • 8.8 /10 High
    CVE-2026-104714 Auth required

    Apache Struts - Race Condition

    Apache Struts 2.0.0 to 2.3.37, 2.5.0 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain a race condition caused by improper synchronization of date/time formatters in localized messages, letting concurrent requests leak data or cause server errors, exploit requires localized messages formatting date/time.

  • 7.5 /10 High
    CVE-2026-104712 No auth

    Apache Struts - Denial of Service

    Apache Struts 2.5.14 to 2.5.33, 6.0.0 to 6.11.0, and 7.0.0 to 7.3.0 contain an asymmetric resource consumption vulnerability caused by binding request parameters to BigDecimal properties rendered via Struts tag library, letting unauthenticated remote attackers exhaust server CPU and network capacity, exploit requires binding and rendering of BigDecimal properties.

  • 9.8 /10 Critical
    CVE-2026-104711 PoC public

    Apache Struts - Expression Language Injection

    Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 contain an expression language injection caused by improper neutralization of OGNL expressions in legacy RESTful action mapper, letting remote attackers execute arbitrary code, exploit requires legacy RESTful action mapper and OGNL allowlist disabled.

  • 8.4 /10 High
    CVE-2026-104706 Auth required

    DigitalCanion Portal - Path Traversal

    DigitalCanion portal contains a path traversal vulnerability caused by improper input validation in Administration -> View Logs menu, letting remote attackers view or download sensitive system files, exploit requires network access.

  • 7.6 /10 High
    CVE-2026-104408 Auth required

    Groundhogg Groundhogg - SQL Injection

    Groundhogg Groundhogg <= 4.8.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.1 /10 High
    CVE-2026-104407 No auth

    Blubrry Podcasting PowerPress Podcasting - Cross-Site Request Forgery

    Blubrry Podcasting PowerPress Podcasting <= 11.17.9 contains a cross site request forgery caused by lack of proper request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 8.5 /10 High
    CVE-2026-104389 Auth required

    Sirv Sirv - SQL Injection

    Sirv Sirv <= 8.2.5 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.

  • 9.5 /10 Critical
    CVE-2026-103510 No auth

    P4 Search - Authentication Bypass

    P4 Search < 2026.4.2 contains a broken authentication caused by failure to securely handle blank service authentication tokens, letting unauthenticated attackers with network access gain highest application privileges.

  • 7.5 /10 High
    CVE-2026-103507 Auth required

    Perforce P4 Search - Unrestricted File Upload

    Perforce P4 Search < 2026.4.2 contains an unrestricted file write vulnerability caused by insufficient path restrictions in the logging configuration interface, letting attackers with service authentication token write arbitrary files, exploit requires service authentication token.

  • 9.3 /10 Critical
    CVE-2026-103352 No auth

    WP BASE Booking - SQL Injection

    WP BASE Booking <= 6.4.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-103349 Auth required

    Rymera Web Co Product Feed PRO for WooCommerce - Insecure Deserialization

    Rymera Web Co Product Feed PRO for WooCommerce <= 13.5.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.2 /10 High
    CVE-2026-103348 Auth required

    Smackcoders Inc. WP Ultimate Exporter - Insecure Deserialization

    Smackcoders Inc. WP Ultimate Exporter <= 3.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-103334 No auth

    Etoile Web Design Incorporated Five Star Restaurant Reservations - Information Disclosure

    Etoile Web Design Incorporated Five Star Restaurant Reservations <= 2.7.24 contains an insertion of sensitive information into sent data vulnerability, letting attackers retrieve embedded sensitive data, exploit requires crafted input.