Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 407 of 695

  • 8.8 /10 High
    CVE-2026-77601 Auth required

    OpenC3 COSMOS - Command Injection

    OpenC3 COSMOS 5.12.0 to 7.3.0 contains a command injection caused by unsanitized pypi_url setting interpolation in shell commands during plugin installation, letting authenticated actors execute arbitrary OS commands as the openc3 service user, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-77423 No auth

    JLine - Denial of Service

    JLine 3.0.0 to 3.30.15 and 4.3.1 contain a denial of service caused by user-controlled nested-quantifier regex patterns in the built-in less viewer, letting attackers cause excessive CPU usage and session blocking, exploit requires sending crafted patterns.

  • 7.5 /10 High
    CVE-2026-77422

    JLine - Denial of Service

    JLine 3.0.0 to 3.30.15 and 4.3.1 contain a denial of service caused by excessive backtracking in user-controlled regular expressions in the built-in grep command, letting remote attackers cause CPU exhaustion, exploit requires remote shell access.

  • 7.6 /10 High
    CVE-2026-77394 Auth required

    OpenC3 COSMOS - Stored XSS

    OpenC3 COSMOS 5.0.6 to 7.3.0 contains a stored XSS caused by evaluation of BUTTON widget action in shared screens, letting authenticated actors with system_set permission steal tokens and take over accounts, exploit requires system_set permission.

  • 7.4 /10 High
    CVE-2026-76980 No auth

    ZohoCorp ManageEngine OpManager & Firewall Analyzer - Information Disclosure

    ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.709 contain a data exposure vulnerability caused by improper handling in the Firewall Analyzer syslog collector, letting attackers access sensitive data, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-76979 Auth required

    ZohoCorp ManageEngine OpManager & Firewall Analyzer - XML External Entity Injection

    ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.709 contain an xml external entity injection caused by improper input handling in the Rule Tracking Compare Policies feature, letting attackers perform XML injection remotely, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-76978 Auth required

    ZohoCorp ManageEngine OpManager & Firewall Analyzer - Command Injection

    ZohoCorp ManageEngine OpManager and Firewall Analyzer <= 12.8.709 contain a command injection caused by improper input handling in the Diagnose Settings feature, letting attackers execute arbitrary commands remotely, exploit requires network access.

  • 8.5 /10 High
    CVE-2026-76648

    CVE-2026-76648

    CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.

  • 9.8 /10 Critical
    CVE-2026-76183 No auth

    Apache Tomcat - Authentication Bypass

    Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain an authentication bypass caused by alternate name handling in WebSocket endpoints, letting attackers bypass security constraints, exploit requires no special conditions.

  • 7.7 /10 High
    CVE-2026-76089 Auth required

    Formie Craft CMS - Broken Access Control

    Formie Craft CMS plugin < 2.2.23 and < 3.1.31 contains an information disclosure vulnerability caused by lack of permission and object-level authorization checks in SentNotificationsController::actionGetResendModalContent, letting authenticated users read recipient headers and email bodies, exploit requires authentication.

  • 8.2 /10 High
    CVE-2026-76087 No auth

    Formie Craft CMS - Broken Access Control

    Formie Craft CMS plugin < 2.2.23 and < 3.1.31 contains a broken access control vulnerability caused by trusting client-supplied submissionId without session binding or ownership validation in SubmissionsController::actionSubmit, letting unauthenticated attackers overwrite or hijack incomplete submissions, exploit requires sequential submission IDs.

  • 8.5 /10 High
    CVE-2026-76086 Auth required

    Formie Craft CMS - Server-Side Request Forgery

    Formie Craft CMS plugin < 2.2.23 and < 3.1.31 contains a server-side request forgery caused by missing permission checks in form-settings action, letting authenticated attackers with low privileges manipulate integration settings and access internal hosts, exploit requires authenticated low-privileged user.

  • 7.3 /10 High
    CVE-2026-75973

    Apache Tomcat - Authentication Bypass

    Apache Tomcat 8.5.0 to 8.5.100, 9.0.0.M4 to 9.0.121, 10.1.0-M1 to 10.1.59, and 11.0.0-M1 to 11.0.25 contain an improper authentication vulnerability caused by shared realm usage with SimpleAuthConfigProvider across multiple web applications, letting attackers bypass authentication, exploit requires multiple web applications using the provider.

  • 7.5 /10 High
    CVE-2026-75887 No auth

    OpenShift console - Path Traversal

    OpenShift console contains a path traversal caused by manipulation of 'lng' and 'ns' query parameters in /locales/resource.json endpoint, letting unauthenticated attackers read sensitive JSON files from the pod filesystem.

  • 7.2 /10 High
    CVE-2026-75886 No auth

    openshift/console - Broken Access Control

    openshift/console contains an information disclosure vulnerability caused by misconfiguration in CatalogdHandler and forwarding of the openshift-session-token cookie, letting unauthenticated remote attackers access internal operator-catalog index and relay into openshift-catalogd namespace, exploit requires no authentication.