Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 292 of 767

  • 7.5 /10 High
    CVE-2026-107579 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.3.4 and 6.3.5 contain a denial of service caused by inefficient algorithmic complexity in bounce and complaint processing, letting remote unauthenticated attackers stop mail delivery by sending crafted messages, exploit requires bounce or complaint processing enabled or mailing list managed.

  • 7.5 /10 High
    CVE-2026-107577 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a denial of service caused by inefficient algorithmic complexity and a non-terminating loop in MIME processing, letting remote unauthenticated attackers make mail services unavailable by sending crafted messages, exploit requires sending specially crafted MIME headers.

  • 7.5 /10 High
    CVE-2026-107576 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains a denial of service vulnerability caused by inefficient algorithmic complexity in inbound DKIM and ARC signature verification, letting remote unauthenticated attackers make mail services unavailable by sending crafted messages.

  • 7.5 /10 High
    CVE-2026-107574 No auth

    Progressive Robot hMailServer - Denial of Service

    Progressive Robot hMailServer contains a denial of service caused by inefficient algorithmic complexity in the JSON reader, letting remote unauthenticated attackers make mail services unavailable by sending crafted large JSON objects, exploit requires sending large crafted TLS-RPT reports or JSON bodies.

  • 7.8 /10 High
    CVE-2026-107573 Auth required

    Progressive Robot hMailServer - Broken Access Control

    Progressive Robot hMailServer 6.0.0 through 6.3.5 contains an information disclosure vulnerability caused by incorrect default permissions on installer-created files and folders, letting local authenticated users read sensitive mail server data, exploit requires local user access.

  • 9.1 /10 Critical
    CVE-2026-107510 Auth required

    Unspecified Product - Privilege Escalation

    An unspecified product contains a privilege escalation caused by injection of arguments in troubleshooting commands, letting authenticated high privilege users escalate their privileges.

  • 7.1 /10 High
    CVE-2026-107503 No auth

    Eclipse Ditto Ditto Explorer - Authentication Bypass

    Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] contains an OAuth authorization code and PKCE verifier theft vulnerability caused by unvalidated environment URLs allowing injected OIDC authority, letting attackers take over accounts by redeeming tokens, exploit requires crafted link with attacker-controlled OIDC authority and autoSso enabled.

  • 9.8 /10 Critical
    CVE-2026-107459 No auth

    Openfind SecuShare Pro - Command Injection

    Openfind SecuShare Pro contains an OS command injection caused by improper input sanitization, letting unauthenticated remote attackers execute arbitrary OS commands on the server, exploit requires no authentication.

  • 9.5 /10 Critical
    CVE-2026-107406 PoC public

    Citrix NetScaler ADC - Remote Code Execution & Denial of Service

    Citrix NetScaler ADC and NetScaler Gateway in specified versions contain a memory overflow vulnerability caused by improper handling in SAML SP or IdP configurations, letting attackers cause remote code execution or denial of service, exploit requires SAML SP or IdP configuration.

  • 7.4 /10 High
    CVE-2026-107385

    MariaDB Connector/Node.js - SQL Injection

    MariaDB Connector/Node.js < 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contains a SQL injection caused by improper text-protocol escaping that ignores NO_BACKSLASH_ESCAPES mode, letting attackers inject arbitrary SQL with database privileges, exploit requires vulnerable sql_mode enabled.

  • 8.1 /10 High
    CVE-2026-107384 No auth

    MariaDB Connector/Node.js - SQL Injection

    MariaDB Connector/Node.js 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contains a SQL injection caused by unescaped keys in permitSetMultiParamEntries option expanding into SQL SET clause, letting attackers execute arbitrary SQL with database user privileges, exploit requires permitSetMultiParamEntries enabled.

  • 7.5 /10 High
    CVE-2026-107383 No auth

    MariaDB Connector/Node.js - Information Disclosure

    MariaDB Connector/Node.js < 3.2.5, < 3.3.4, < 3.4.7, and < 3.5.4 contains an information disclosure caused by improper validation of GeoJSON Polygon and MultiPolygon rings in binary encoders, letting attackers disclose uninitialized Node.js heap data via database values, exploit requires sending malformed non-array rings.

  • 8.7 /10 High
    CVE-2026-107378 No auth

    CairoSVG - Denial of Service

    CairoSVG < 2.9.1 contains a denial of service caused by inefficient path processing in path.py, letting attackers cause high CPU consumption by rendering crafted SVGs, exploit requires attacker to provide malicious SVG input.

  • 7.5 /10 High
    CVE-2026-107377 No auth

    datamodel-code-generator - Path Traversal

    datamodel-code-generator 0.59.0 to 0.81.0 contains a path traversal caused by attacker-controlled Protobuf schema paths processed by _write_missing_weak_imports, letting attackers create or overwrite files, exploit requires processing Protobuf schema with grpcio-tools.

  • 8.2 /10 High
    CVE-2026-107376 No auth

    webonyx graphql-php - Denial of Service

    webonyx graphql-php < 15.32.3 contains a denial of service caused by lack of recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference, letting remote attackers exhaust PHP process stack, exploit requires crafted deeply nested queries.