Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 311 of 767

  • 7.5 /10 High
    CVE-2026-96399 No auth

    Gitea - Denial of Service

    Gitea contains a denial of service caused by invalid slice indexes from external issue tracker regex with alternating capture groups, letting users who can edit issue tracker settings crash the instance, exploit requires repository settings modification.

  • 8.1 /10 High
    CVE-2026-95594 No auth

    SMS Alert Order Notifications - Privilege Escalation

    SMS Alert Order Notifications <= 4.0.0 contains a privilege escalation vulnerability caused by unauthenticated access, letting attackers escalate privileges without authentication.

  • 7.3 /10 High
    CVE-2026-95526 No auth

    BEAR - Broken Access Control

    BEAR <= 1.2.2 contains a broken access control vulnerability caused by improper authorization checks, letting unauthenticated attackers access restricted resources, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-95140 No auth

    kkFileView - Path Traversal

    kkFileView v5.0.0 through v5.0.2 contains a path traversal vulnerability caused by improper validation of the "path" parameter in FileController.java endpoints, letting unauthenticated attackers create directories and write files outside the intended root via crafted multipart requests.

  • 9.1 /10 Critical
    CVE-2026-95106 No auth

    Gitea - Path Confusion

    Gitea contains a path confusion vulnerability caused by accepting pushed Git trees with duplicate entries, letting contributors cause inconsistent file views between web and git checkout, exploit requires repository push access.

  • 8.2 /10 High
    CVE-2026-95105

    danielberkompas cloak - Reliance on Obfuscation or Encryption without Integrity Checking

    danielberkompas cloak from 0.1.0-pre onward contains a reliance on obfuscation or encryption of security-relevant inputs without integrity checking caused by use of AES-256 CTR mode encryption without MAC, letting attackers with write access to ciphertext modify decrypted plaintext via bit flipping, exploit requires write access to encrypted store.

  • 7.1 /10 High
    CVE-2026-94675 No auth

    Fluent Forms Pro Add On Pack - Reflected XSS

    Fluent Forms Pro Add On Pack <= 6.2.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-94293 No auth

    Asset Administration Shell - Broken Access Control

    Asset Administration Shell contains a broken access control vulnerability caused by unauthenticated remote attacker modifying submodel data via PATCH requests and reading data via GET endpoints, letting attackers modify and read data without authentication.

  • 9.8 /10 Critical
    CVE-2026-94205 PoC publicNo auth

    Gitea - Broken Access Control

    Gitea Actions contains a broken access control vulnerability caused by incorrect approval checks on fork pull request runs, letting attackers run fork-controlled workflow code on base repository runners without explicit approval, exploit requires Actions enabled and matching runner registered.

  • 9.6 /10 Critical
    CVE-2026-91140 No auth

    Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator - Command Injection

    Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 contains a command injection caused by shell-based temporary-file cleanup instructions, letting attackers execute arbitrary OS commands on developer machines, exploit requires crafted Swagger/OpenAPI document.

  • 8.1 /10 High
    CVE-2026-89430 Auth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by insufficient validation of push mirror remote addresses during synchronization, letting repository administrators force-push to internal or blocked Git services, exploit requires admin access to repository.

  • 7.1 /10 High
    CVE-2026-86684 PoC publicAuth required

    Gitea - Broken Access Control

    Gitea contains a broken access control vulnerability caused by improper permission checks in the push mirror API allowing repository administrators to push to local file system paths if the repository owner has permission, exploit requires repository administrator privileges.

  • 8.2 /10 High
    CVE-2026-86362 Auth required

    Dell System Update - Elevation of Privileges

    Dell System Update < 2.3.0.0 contains an improper access control vulnerability caused by flawed access restrictions, letting low privileged local attackers escalate privileges, exploit requires local access.

  • 8.2 /10 High
    CVE-2026-86361 Auth required

    Dell System Update - Privilege Escalation

    Dell System Update < 2.3.0.0 contains an incorrect permission assignment for critical resource, letting low privileged local attackers escalate privileges, exploit requires local access.

  • 9.6 /10 Critical
    CVE-2026-86360 No auth

    Dell System Update - Path Traversal

    Dell System Update < 2.3.0.0 contains a path traversal caused by improper limitation of pathname in the application, letting unauthenticated remote attackers access filesystem and execute arbitrary code with root privileges.