Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 419 of 695
- 7.4 /10 HighCVE-2026-77246 PoC publicNo auth
MCP Atlassian - Authorization Bypass
MCP Atlassian < 0.22.0 contains an authorization bypass caused by accepting requests without identity and allowing attacker-controlled service headers, letting attackers upload server-local files to attachment endpoints, exploit requires READ_ONLY_MODE=false.
- 10.0 /10 CriticalCVE-2026-77244 PoC public
MCP Atlassian - Broken Access Control
MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by accepting requests without verified user identity in HTTP transport, letting network clients invoke Atlassian tools as the operator, exploit requires network access to MCP endpoint.
- 8.8 /10 HighCVE-2026-77243 PoC public
MCP Atlassian - Broken Access Control
MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by improper rechecking of ENABLED_TOOLS and TOOLSETS during tools/call requests, letting clients invoke excluded read, write, or delete tools despite least-privilege restrictions, exploit requires knowledge of hidden tool names.
- 7.5 /10 HighCVE-2026-77242 PoC publicNo auth
MCP Atlassian - Server Side Request Forgery
MCP Atlassian < 0.22.0 contains a server-side request forgery caused by inconsistent DNS resolution in validate_url_for_ssrf and connection libraries, letting unauthenticated attackers access internal or metadata endpoints, exploit requires crafted URL with short-lived DNS.
- 7.1 /10 HighCVE-2026-76715
Analytics and Location Engine - Remote Code Execution
Analytics and Location Engine contains a man-in-the-middle vulnerability in an administrative component, letting unauthenticated remote attackers execute arbitrary code with root privileges, exploit requires network access to the component.
- 7.2 /10 HighCVE-2026-76714 Auth required
Analytics and Location Engine - Command Injection
Analytics and Location Engine web interface contains a command injection caused by vulnerabilities in the web interface, letting remote authenticated users execute arbitrary commands as root, exploit requires authentication.
- 7.2 /10 HighCVE-2026-76713 Auth required
Analytics and Location Engine - Privilege Escalation
Analytics and Location Engine contains a privilege escalation caused by improper access control in maintenance restore functionality, letting authenticated remote attackers gain root file system access, exploit requires authentication.
- 7.3 /10 HighCVE-2026-76712 No auth
Analytics and Location Engine - Information Disclosure & Denial of Service
Analytics and Location Engine contains an information disclosure, security bypass, and denial of service vulnerability caused by improper input handling and network communication interception, letting unauthenticated remote attackers access sensitive information, bypass security controls, or cause denial of service, exploit requires network access.
- 7.5 /10 HighCVE-2026-76711 No auth
Analytics and Location Engine - Data Tampering
Analytics and Location Engine contains a data tampering vulnerability caused by improper processing of incoming socket connections, letting unauthenticated remote attackers inject unauthorized data, exploit requires crafted input during connection.
- 7.5 /10 HighCVE-2026-76710 No auth
Analytics and Location Engine - Information Disclosure
Analytics and Location Engine (ALE) contains an information disclosure vulnerability caused by unauthenticated access to internal endpoints, letting remote attackers disclose sensitive site hierarchy, infrastructure, and client device information, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-76709 No auth
Analytics and Location Engine - Broken Access Control
Analytics and Location Engine contains a broken access control vulnerability in the internal administrative component, letting unauthenticated remote attackers gain unauthorized write access to the file system with elevated privileges, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-76708 No auth
Analytics and Location Engine - Authentication Bypass
Analytics and Location Engine contains a hardcoded credentials vulnerability caused by use of default credentials for administrative and system accounts, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special privileges.
- 8.6 /10 HighCVE-2026-75791 No auth
Zohocorp ManageEngine ADSelfService Plus - Authentication Bypass
Zohocorp ManageEngine ADSelfService Plus < 7001 contains an authentication bypass caused by a flaw in the REST API, letting attackers bypass authentication, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-75745 No auth
Adobe Experience Manager Forms JEE - Authentication Bypass
Adobe Experience Manager Forms JEE contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 8.1 /10 HighCVE-2026-75744 Auth required
Adobe Experience Manager Forms JEE - Stored XSS
Adobe Experience Manager Forms JEE contains a stored XSS vulnerability caused by improper sanitization of form fields, letting high-privileged attackers inject malicious scripts, exploit requires high privileges.