Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 563 of 677

  • 8.8 /10 High
    CVE-2026-82428 Auth required

    Apache Storm - Remote Code Execution

    Apache Storm before 3.1.0 contains a remote code execution vulnerability caused by predictable blob keys for dependency artifacts uploaded with `storm jar --artifacts`, letting a malicious user inject code into other tenants' topologies, exploit requires multi-tenant cluster and use of `--artifacts` feature.

  • 7.8 /10 High
    CVE-2026-82427 Auth required

    Apache Storm - Path Traversal & Remote Code Execution

    Apache Storm contains a path traversal vulnerability in topology.blobstore.map allowing submitters to manipulate symlink targets, letting attackers as supervisor user delete files and execute code as other OS users, exploit requires topology submission.

  • 9.8 /10 Critical
    CVE-2026-82232 No auth

    Apache Syncope - SQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized sort clauses in Task search, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.

  • 8.4 /10 High
    CVE-2026-82049 No auth

    CPython - Path Traversal

    CPython <= 3.13 contains a symlink & hard link vulnerability in the tarfile module's data and extraction filters, letting attackers modify file metadata or expose file contents outside the extraction directory, exploit requires crafted archive.

  • 7.1 /10 High
    CVE-2026-82035 No auth

    PyMuPDF - Path Traversal

    PyMuPDF <= 1.28.2 contains a path traversal vulnerability caused by improper sanitization of BaseFont names in extract_objects() font branch, letting attackers write arbitrary files outside the output directory, exploit requires crafted document input.

  • 8.8 /10 High
    CVE-2026-82028 Auth required

    Magistrala - SQL Injection

    Magistrala < 1.0.0 contains a SQL injection caused by unsafe interpolation of the format query parameter in timescale-reader and postgres-reader HTTP API services, letting authenticated attackers execute arbitrary SQL with superuser privileges.

  • 8.1 /10 High
    CVE-2026-81902 No auth

    Concrete CMS - Cross-Site Request Forgery

    Concrete CMS 9 through 9.5.2 contains a cross-site request forgery caused by missing CSRF token validation in the orphaned block removal panel action, letting remote attackers delete page blocks via an authenticated user with edit permissions.

  • 8.7 /10 High
    CVE-2026-81901 Auth required

    Concrete CMS - Stored XSS

    Concrete CMS 9.2.0 through 9.5.2 contains a stored XSS caused by missing authorization checks on page properties, templates, and types in the REST API page update endpoint, letting users with content-editing rights persist JavaScript executing in visitors' browsers, exploit requires user with content-editing rights.

  • 7.5 /10 High
    CVE-2026-78336 No auth

    Apache Syncope - Information Disclosure

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure caused by returning OIDC provider configurations including client secrets to any authenticated user, letting attackers access sensitive configuration data, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-78330 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect privilege assignment vulnerability caused by disclosure of JWKS settings in internal JWT authentication, letting attackers escalate to admin privileges after authentication, exploit requires valid low-privilege JWT.

  • 9.1 /10 Critical
    CVE-2026-78299 No auth

    Eclipse Embedded CDT - Unrestricted File Upload

    Eclipse Embedded CDT 6.0 to 6.7 contains an unrestricted file write vulnerability caused by extraction of a compromised CMSIS pack archive, letting attackers write arbitrary files outside intended directories, exploit requires crafted CMSIS pack.

  • 9.8 /10 Critical
    CVE-2026-77181 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper entitlement checks on ClientApp update operations, letting administrators perform unauthorized actions, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-77051 No auth

    Apache Syncope - SQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized entityKey and opEvent parameters, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-76461 CISA KEVPoC publicNo auth

    Cisco AsyncOS Software for Cisco Secure Email Gateway - Command Injection

    Cisco AsyncOS Software for Cisco Secure Email Gateway contains a command injection caused by insufficient validation in email parsing logic, letting unauthenticated remote attackers execute arbitrary commands with root privileges, exploit requires sending crafted email messages.

  • 9.8 /10 Critical
    CVE-2026-76443

    CVE-2026-76443

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.