Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 291 of 767
- 7.3 /10 HighCVE-2026-107716
Banks DirectoryPromptRegistry - Path Traversal
Banks DirectoryPromptRegistry < 2.5.1 contains a symbolic link handling vulnerability caused by lack of symlink rejection in index.json and .jinja prompt files, letting attackers with influence over the prompt directory read or overwrite external files, exploit requires attacker control over the registry directory or its contents.
- 7.8 /10 HighCVE-2026-107709 No auth
Bower decompress-zip - Path Traversal
Bower decompress-zip <= 0.3.3 contains a path traversal vulnerability caused by improper validation of archive entry paths in lib/decompress-zip.js, letting attackers overwrite arbitrary files during ZIP extraction, exploit requires crafted ZIP archive.
- 7.8 /10 HighCVE-2026-107707 Auth required
Intego Antivirus for Windows - Remote Code Execution
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in the optimization module, letting local unprivileged attackers delete arbitrary folders and execute code as SYSTEM by abusing Windows Installer rollback, exploit requires local access.
- 9.8 /10 CriticalCVE-2026-107704 No auth
image_optimizer Ruby gem - Command Injection
image_optimizer Ruby gem 1.3.0 through 1.9.0 contains a command injection caused by improper sanitization of image path in ImageOptimizer#identify_format, letting attackers execute OS commands with Ruby process privileges, exploit requires crafted image path with shell metacharacters.
- 9.8 /10 CriticalCVE-2026-107703 No auth
@enmaso/node-convert - Command Injection
@enmaso/node-convert <= 1.0.0 contains a command injection caused by unsanitized filepath and convertTo arguments in convert.js, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input.
- 8.2 /10 HighCVE-2026-107701 No auth
dot-access - Prototype Pollution
dot-access contains a prototype pollution vulnerability caused by crafted dotted path input to set(), letting attackers modify Object.prototype to alter authorization flags, option defaults, or crash the process, exploit requires attacker control of input path.
- 9.8 /10 CriticalCVE-2026-107700 No auth
dot-access - Command Injection
dot-access 0.0.3 through 1.0.0 contains a command injection caused by concatenation of crafted paths into a new Function body in index.js, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-107699 No auth
ppt2png - Command Injection
ppt2png <= 0.0.6 contains a command injection caused by unsanitized input in file name arguments to child_process.exec() in ppt2png.js, letting attackers execute OS commands with Node.js process privileges.
- 9.1 /10 CriticalCVE-2026-107640 No auth
Integrics Enswitch - Authentication Bypass
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass caused by omission of the reset parameter in /api/json/user/password/update/, letting unauthenticated attackers change account passwords and take over administrator accounts, exploit requires valid username enumeration.
- 8.8 /10 HighCVE-2026-107639 Auth required
ILIAS - Remote Code Execution
ILIAS < 9.24, 10.x < 10.12, and 11.x < 11.5 contain a command injection caused by improper sanitization of ImageMagick convert options in uploaded image filenames in assImagemapQuestionGUI, letting question authors execute remote code by writing PHP files under the web root, exploit requires question author privileges.
- 7.8 /10 HighCVE-2026-107615 Auth required
GlavSoft TightVNC Server - Remote Code Execution & Privilege Escalation
GlavSoft TightVNC Server for Windows < 2.8.88 contains an uncontrolled search path element vulnerability caused by loading DLLs without secure search flags, letting local authenticated users execute arbitrary code with SYSTEM privileges.
- 7.8 /10 HighCVE-2026-107612 Auth required
GlavSoft TightVNC Server - Broken Access Control
GlavSoft TightVNC Server for Windows < 2.8.88 contains an incorrect permission assignment caused by a NULL DACL on a named shared memory segment with predictable name, letting local authenticated users read or overwrite IPC handles, exploit requires local authentication.
- 7.1 /10 HighCVE-2026-107611
GlavSoft TightVNC Viewer - Out-of-Bounds Read
GlavSoft TightVNC Viewer for Windows < 2.8.88 contains an out-of-bounds read vulnerability caused by improper validation of palette indices in the ZRLE decoder, letting malicious VNC servers read heap memory and crash the viewer remotely, exploit requires a malicious or compromised VNC server.
- 7.5 /10 HighCVE-2026-107589 Auth required
Jacamar CI - Authentication Bypass
Jacamar CI < 0.30.0 contains an authentication bypass caused by insufficient job validation for service accounts, letting authenticated CI users generate arbitrary account names, exploit requires user authentication.
- 7.4 /10 HighCVE-2026-107584
Progressive Robot hMailServer - Man-in-the-Middle
Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a misconfiguration in DANE implementation caused by improper DNSSEC validation in the DNS resolver, letting attackers on the DNS or SMTP path disable DANE and intercept or modify emails, exploit requires attacker to control or manipulate DNS responses and be active on SMTP path.