Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 305 of 767
- 8.8 /10 HighCVE-2026-106558 Auth required
Backstage - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.8, < 1.15.6, and < 2.0.1 contains a remote code execution caused by improper validation of mapping-style markdown_extensions configuration, letting authenticated attackers bypass sanitization and execute arbitrary code during documentation generation, exploit requires attacker to register or influence SCM-backed documentation source.
- 7.7 /10 HighCVE-2026-106557 Auth required
Backstage @backstage/plugin-techdocs-node - Broken Access Control
Backstage @backstage/plugin-techdocs-node < 1.14.6 and < 1.15.4 contains an information disclosure caused by insufficient validation of TechDocs Markdown extension configuration, letting authenticated users access resources outside intended documentation boundaries, exploit requires authenticated user with documentation source modification privileges.
- 7.7 /10 HighCVE-2026-106556 Auth required
Backstage @backstage/plugin-techdocs-node - Command Injection
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a command injection caused by insufficient validation of MkDocs configuration in techdocs mkdocs.yml sanitization, letting authenticated users who can register or modify documentation sources execute arbitrary commands in the build environment.
- 7.7 /10 HighCVE-2026-106510 Auth required
Backstage @backstage/plugin-techdocs-node - Remote Code Execution
Backstage @backstage/plugin-techdocs-node < 1.14.6 contains a remote code execution caused by crafted markdown_extensions in techdocs mkdocs.yml, letting authenticated users who can register catalog entities execute arbitrary OS commands on the TechDocs build host, exploit requires authenticated user with catalog entity registration rights.
- 8.1 /10 HighCVE-2026-106471 Auth required
Candlepin - Broken Access Control
Candlepin contains a broken access control caused by incorrect authorization filter logic in @Verify-annotated parameters, letting low-privilege authenticated attackers bypass authorization to disclose and modify subscription data.
- 7.3 /10 HighCVE-2026-106164 No auth
In Progress Telerik Document Processing - Denial of Service
In Progress Telerik Document Processing SpreadProcessing library < 2026.3.1006 contains a denial of service caused by infinite loop when importing a specifically corrupted XLS file, letting attackers cause unresponsive CPU thread, exploit requires crafted XLS file.
- 8.8 /10 HighCVE-2026-106059 No auth
GitAhead - Command Injection
GitAhead through 2.7.1 on macOS contains a command injection caused by unescaped repository filenames interpolated into Show in Finder AppleScript, letting attackers execute shell commands as the victim user, exploit requires crafted repository filenames.
- 7.5 /10 HighCVE-2026-106058 No auth
GitAhead - Command Injection
GitAhead through 2.7.1 contains a command injection caused by crafted filenames substituted into clean/smudge filter commands in src/git/Filter.cpp, letting attackers execute arbitrary OS commands during checkout or staging, exploit requires malicious repository with crafted filenames.
- 7.8 /10 HighCVE-2026-106057 No auth
patool - Command Injection
patool before 4.0.6 contains a command injection caused by shell_quote_nt failing to escape cmd.exe metacharacters or embedded double quotes in archive filenames on Windows, letting attackers execute arbitrary commands with patool process privileges, exploit requires crafted archive filenames.
- 7.5 /10 HighCVE-2026-106056 Auth required
Rundeck - Command Injection
Rundeck < 6.2.0 contains a command injection caused by improper sanitization of option values in Windows node execution, letting authenticated users with job run permission execute arbitrary OS commands.
- 8.0 /10 HighCVE-2026-105816 Auth required
Vault - Remote Code Execution
Vault and Vault Enterprise < 2.1.2, 1.21.12, 1.20.17, 1.19.23 contain a remote code execution caused by improper verification of plugin catalog entries referencing binaries outside the configured plugin directory, letting privileged operators executing arbitrary code on the Vault host, exploit requires privileged operator restoring an Integrated Storage snapshot.
- 9.2 /10 CriticalCVE-2026-105324 No auth
ADM - HTTP Header Injection
ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21 contain an HTTP header injection caused by crafted HTTP requests with injected headers via the state parameter in start-page-loader.cgi, letting unauthenticated remote attackers read arbitrary files using X-Sendfile.
- 7.1 /10 HighCVE-2026-105316 No auth
Magee Shortcodes WordPress - Reflected XSS
Magee Shortcodes WordPress plugin through 2.1.1 contains a reflected XSS caused by unsanitized and unescaped user input in AJAX actions, letting unauthenticated attackers execute scripts, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-105192 PoC public
LMCache - Remote Code Execution
LMCache multiprocess mode contains a remote code execution caused by unauthenticated ZeroMQ ROUTER message deserialization via pickle.loads, letting unauthenticated attackers execute code as the LMCache process user, exploit requires network access to the transport port.
- 7.2 /10 HighCVE-2026-104677 Auth required
WP Coder - Broken Access Control
WP Coder WordPress plugin < 4.5.2 contains a broken access control caused by insufficient restriction on PHP code-execution feature, letting Editor-level users execute arbitrary PHP code and fully compromise the site, exploit requires Editor role privileges.