Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 306 of 767

  • 8.8 /10 High
    CVE-2026-104335 PoC publicAuth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper access control, letting remote authenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-104334 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper control of code generation, letting remote attackers execute arbitrary code, exploit requires no special privileges.

  • 8.6 /10 High
    CVE-2026-103668 No auth

    Movable Type - SQL Injection

    Movable Type contains an SQL injection caused by improper sanitization in the Site Search function, letting unauthenticated attackers execute arbitrary SQL queries remotely, exploit requires no special privileges.

  • 7.7 /10 High
    CVE-2026-103435 No auth

    Claude Code - Race Condition

    Claude Code contains a race condition TOCTOU vulnerability caused by re-resolving file paths without repeated validation, letting attackers with write access to the workspace redirect writes to arbitrary files outside the sandbox.

  • 9.3 /10 Critical
    CVE-2026-103416

    Eclipse ThreadX NetX Duo - Out-of-Bounds Write

    Eclipse ThreadX NetX Duo 6.5.1.202602 contains an out-of-bounds write caused by a TLS 1.3 handshake message larger than the cache in the handshake message cache, letting a malicious or compromised server corrupt memory before certificate authentication completes, exploit requires a malicious server to send crafted handshake messages.

  • 7.5 /10 High
    CVE-2026-103371 No auth

    Apache Geode - Information Disclosure

    Apache Geode 2.0.0 to < 2.0.3 contains an insertion of sensitive information into log file caused by improper handling in web management, letting attackers access sensitive data via logs, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-103360 Auth required

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.12.2 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting remote authenticated attackers obtain sensitive information.

  • 9.3 /10 Critical
    CVE-2026-102782 PoC publicNo auth

    Joomla Extension ordasoft.com Simple Membership - SQL Injection

    Joomla Extension ordasoft.com Simple Membership < 7.4.0 contains an unauthenticated SQL injection caused by unsanitized input in site/simplemembership.php dispatching task=checkLoginPass, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 8.7 /10 High
    CVE-2026-102478 Auth required

    Octopus Server - Broken Access Control

    Octopus Server contains a broken access control vulnerability caused by improper validation of unsafe equivalence in inputs, letting authenticated users with role modification permissions escalate privileges by weakening built-in roles and adding themselves to privileged teams.

  • 7.2 /10 High
    CVE-2026-102257 Auth required

    SMA1000 Appliance Management Console - Path Traversal

    SMA1000 Appliance Management Console contains a path traversal caused by specially crafted archive extraction in AMC interface, letting remote attackers execute arbitrary code, exploit requires crafted archive upload.

  • 7.8 /10 High
    CVE-2026-102256 Auth required

    SMA1000 - OS Command Injection

    SMA1000 appliance contains an OS command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated administrators execute arbitrary OS commands, exploit requires administrator privileges.

  • 10.0 /10 Critical
    CVE-2026-102255 CISA KEVPoC publicNo auth

    SMA1000 Appliance - Server Side Request Forgery

    SMA1000 Appliance Work Place interface contains a server side request forgery caused by an unintended alternate access path, letting remote unauthenticated attackers perform unauthorized internal requests, exploit requires no authentication.

  • 7.2 /10 High
    CVE-2026-102173 No auth

    Kirki Freeform Page Builder - Stored XSS

    Kirki Freeform Page Builder plugin for WordPress <= 6.3.1 contains a stored cross-site scripting caused by insufficient escaping in ExceptionalElements::image_element() concatenating user-meta into img src attribute, letting unauthenticated attackers execute arbitrary scripts, exploit requires public user registration and a published page with kirki-register element.

  • 7.7 /10 High
    CVE-2026-101331 Auth required

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.12.2 contains an information disclosure vulnerability caused by insufficiently protected credentials, letting remote authenticated attackers obtain sensitive information, exploit requires authentication.

  • 8.8 /10 High
    CVE-2025-70522 No auth

    Fanvil x7a - Cross-Site Request Forgery

    Fanvil x7a firmware version 2.6.0.1182 contains a cross-site request forgery vulnerability caused by lack of cross-origin resource protection in request handler, letting attackers perform state-changing requests across origins, exploit requires victim interaction.