Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 420 of 695

  • 7.1 /10 High
    CVE-2026-75743 No auth

    Adobe Experience Manager Forms JEE - Cross-Site Request Forgery

    Adobe Experience Manager Forms JEE contains a cross-site request forgery caused by insufficient request validation, letting attackers bypass security features and gain unauthorized write access, exploit requires victim interaction with malicious URL or page.

  • 9.1 /10 Critical
    CVE-2026-75728 No auth

    Adobe Campaign Classic - Authentication Bypass

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75723 No auth

    Adobe Campaign Classic - Authentication Bypass

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75721 No auth

    Adobe Campaign Classic - Command Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75703 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75699 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-75698 No auth

    Adobe Connect - Reflected XSS

    Adobe Connect contains a reflected XSS caused by improper input sanitization, letting attackers inject malicious scripts to gain elevated access or control, exploit requires victim interaction with crafted URL or page.

  • 9.3 /10 Critical
    CVE-2026-75697 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.3 /10 Critical
    CVE-2026-75689 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.3 /10 Critical
    CVE-2026-75686 No auth

    Adobe Connect - Remote Code Execution

    Adobe Connect contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires victim interaction with a malicious URL or web page.

  • 9.3 /10 Critical
    CVE-2026-75684 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.9 /10 Critical
    CVE-2026-75682 Auth required

    Adobe Connect - SQL Injection

    Adobe Connect contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary SQL commands and potentially escalate privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-75676 No auth

    Bridge - Buffer Overflow

    Bridge contains a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-75665 No auth

    Bridge - Remote Code Execution

    Bridge contains a heap-based buffer overflow caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.

  • 7.8 /10 High
    CVE-2026-75663 No auth

    Bridge - Remote Code Execution

    Bridge contains an out-of-bounds write vulnerability caused by improper memory handling, letting attackers execute arbitrary code in the context of the current user, exploit requires victim to open a malicious file.