Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 399 of 767
- 7.0 /10 HighCVE-2026-102127 No auth
Kiteworks Email Protection Gateway - XML External Entity Injection
Kiteworks Email Protection Gateway contains an XML external entity injection caused by unrestricted external entity references in an optional message-processing feature, letting remote unauthenticated attackers read files accessible to the gateway service account.
- 8.1 /10 HighCVE-2026-102126 Auth required
Kiteworks Core - Stored XSS
Kiteworks Core contains a stored XSS caused by insufficient input sanitization allowing a delegated administrator to store crafted content that executes arbitrary JavaScript in a System Administrator's session, exploit requires delegated admin privileges.
- 8.8 /10 HighCVE-2026-102125 Auth required
Kiteworks appliance - Broken Access Control
Kiteworks appliance contains a sandbox escape vulnerability caused by incomplete confinement of code running inside the document conversion sandbox, letting attackers with sandbox access read/modify data or disrupt service.
- 7.4 /10 HighCVE-2026-102123
Kiteworks Appliance - Unrestricted File Upload
Kiteworks appliance contains an unrestricted file write caused by improper confinement of user-supplied file paths in the setup interface, letting unauthenticated attackers write files to any writable location, exploit requires network access during provisioning or non-default configuration.
- 8.6 /10 HighCVE-2026-102121 No auth
Kiteworks Advanced Forms - Information Disclosure
Kiteworks Advanced Forms component contains an information disclosure caused by excessive data returned in form-rendering interface accessible without authentication, letting anonymous visitors retrieve form owner profile and deployment configuration, exploit requires knowing the form URL.
- 8.8 /10 HighCVE-2026-102120 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a privilege escalation caused by insufficient input validation in an internal cluster management function, letting attackers with code execution on one node run commands with elevated privileges on another node, exploit requires existing node access.
- 7.2 /10 HighCVE-2026-102119 Auth required
Unknown Product - Path Traversal
An optional non-default administrative feature contains a path traversal caused by improper file path validation, letting authenticated administrators move files outside designated directories, potentially leading to code execution.
- 7.8 /10 HighCVE-2026-102118 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a local privilege escalation caused by improper privilege management, letting attackers with low-privileged shell escalate to root privileges on the appliance, exploit requires existing shell access.
- 7.2 /10 HighCVE-2026-102117 Auth required
Product - Command Injection
A product with remote-support capability enabled contains a command injection caused by redirection of outbound support connection, letting authenticated System Administrators with key execute OS commands remotely, exploit requires admin authentication and key possession.
- 7.2 /10 HighCVE-2026-102116 Auth required
Kiteworks Email Protection Gateway - Remote Code Execution
Kiteworks Email Protection Gateway contains a file write vulnerability caused by insufficient validation, letting authenticated administrators write and execute files outside intended locations, potentially leading to remote code execution.
- 9.8 /10 CriticalCVE-2026-102115 No auth
Kiteworks Core - Authentication Bypass
Kiteworks Core contains a broken authentication caused by improper validation of a parameter in the password reset workflow, letting unauthenticated attackers reset passwords and authenticate as users, including admins, without the reset link.
- 7.2 /10 HighCVE-2026-102114 Auth required
Kiteworks - Command Injection
Kiteworks contains a command injection caused by improper input handling, letting high-privileged authenticated administrators execute arbitrary OS commands as root, exploit requires administrative privileges.
- 7.8 /10 HighCVE-2026-102113 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a privilege escalation caused by unsafe handling of filesystem paths in a privileged routine, letting attackers with unprivileged backend service code execution escalate to root, exploit requires local access to service account.
- 7.8 /10 HighCVE-2026-102112 Auth required
Kiteworks - Privilege Escalation
Kiteworks contains a privilege escalation vulnerability caused by improper privilege management, letting attackers with unprivileged backend service account escalate to root and execute arbitrary commands, exploit requires local access to service account.
- 7.1 /10 HighCVE-2026-102109 Auth required
Kiteworks Secure Data Forms - SQL Injection
Kiteworks Secure Data Forms contains a sql injection caused by unsanitized user-derived account data in database queries, letting authenticated users inject SQL, exploit requires authenticated session and specific optional feature enabled.