Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 418 of 695

  • 7.5 /10 High
    CVE-2026-77556 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an out-of-bounds read vulnerability that allows a network attacker to cause denial of service by crashing the device, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-77555 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an out-of-bounds write vulnerability that allows a network attacker to cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-77544 No auth

    UniFi Gateway - Denial of Service

    UniFi gateway devices contain an out-of-bounds write vulnerability that allows a network attacker to cause denial of service, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-77322 No auth

    SIPGO - Denial of Service

    SIPGO < 1.4.3 contains a denial of service caused by missing MaxFrameSize in WSConnection.Read leading to oversized allocation or panic in wsutil.Reader, letting unauthenticated WS/WSS peers crash or exhaust server memory, exploit requires unauthenticated network access.

  • 8.2 /10 High
    CVE-2026-77274 PoC publicNo auth

    MCP Atlassian - Server Side Request Forgery

    MCP Atlassian < 0.22.0 contains a server-side request forgery caused by backslash authority confusion in validate_url_for_ssrf during header-based Jira and Confluence URL authentication, letting attackers access protected internal network resources, exploit requires crafted URL.

  • 8.8 /10 High
    CVE-2026-77271 PoC public

    MCP Atlassian - Code Injection

    MCP Atlassian < 0.22.0 contains a code injection vulnerability caused by insecure default base directory in validate_safe_path allowing attacker-selected writes in working directory, letting attackers achieve code execution when the application imports the modified module, exploit requires ability to write files in working directory.

  • 8.6 /10 High
    CVE-2026-77262 PoC publicNo auth

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by lack of path restriction in confluence_upload_attachment file_path, letting attackers upload arbitrary server-readable files to Confluence, exploit requires attacker control of file_path.

  • 7.1 /10 High
    CVE-2026-77261 PoC public

    MCP Atlassian - Server Side Request Forgery

    MCP Atlassian < 0.22.0 contains a server side request forgery caused by omission of _make_ssrf_safe_hook in JiraFetcher and ConfluenceFetcher sessions, letting attackers follow redirects to internal addresses without revalidation, exploit requires attacker-controlled or compromised Atlassian instance.

  • 7.5 /10 High
    CVE-2026-77260 PoC publicNo auth

    MCP Atlassian - Information Disclosure

    MCP Atlassian < 0.22.0 contains an information disclosure caused by unconstrained file_path handling in upload_attachment, letting permitted MCP callers upload and retrieve sensitive host files, exploit requires MCP caller permissions.

  • 7.7 /10 High
    CVE-2026-77259 PoC publicAuth required

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by lack of path validation in confluence_upload_attachment, letting attackers upload and read arbitrary server-local files, exploit requires attacker to control file path input.

  • 7.7 /10 High
    CVE-2026-77258 PoC publicAuth required

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by caller-controlled file_path in upload_attachment, letting permitted Confluence MCP callers disclose server-local files, exploit requires MCP caller permissions.

  • 8.6 /10 High
    CVE-2026-77255 PoC publicNo auth

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by lack of workspace validation in the attachments argument of jira update_issue, letting attackers read arbitrary local files and attach them to Jira issues, exploit requires crafted attachments argument.

  • 9.1 /10 Critical
    CVE-2026-77254 PoC public

    MCP Atlassian - Broken Access Control

    MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by allowing requests without per-user identity to use global Jira or Confluence credentials, letting network attackers perform operations with operator permissions, exploit requires lack of independent authentication boundary.

  • 7.1 /10 High
    CVE-2026-77253 PoC publicAuth required

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by accepting arbitrary local filesystem paths in attachment upload tools, letting remote attackers disclose sensitive files across client-server boundary, exploit requires network access.

  • 8.6 /10 High
    CVE-2026-77248 No auth

    MCP Atlassian - Broken Access Control

    MCP Atlassian < 0.22.0 contains a broken access control caused by accepting requests without user identity and unrestricted file_path in upload_attachment, letting unauthenticated attackers read and upload files to Jira or Confluence, exploit requires network access without authentication.