Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 564 of 677

  • 7.5 /10 High
    CVE-2026-76442

    CVE-2026-76442

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.

  • 9.8 /10 Critical
    CVE-2026-76441 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Broken Access Control

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain an improper access control vulnerability caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76440 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Path Traversal

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain path traversal vulnerabilities caused by improper input validation, letting attackers access unauthorized files, exploit requires crafted requests.

  • 9.8 /10 Critical
    CVE-2026-75030 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a missing authorization vulnerability caused by insufficient group administration checks, letting administrators with task execution entitlements mass (de)provision group members beyond their privileges, exploit requires administrator with task execution entitlements.

  • 9.8 /10 Critical
    CVE-2026-73668 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by inadequate realm access control in REST API, letting administrators read confidential connector configurations from other realms, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-73579 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by an empty Realms filter in non-recursive search requests, letting attackers bypass permission restrictions, exploit requires crafted non-recursive search requests.

  • 7.7 /10 High
    CVE-2026-73496 Auth required

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by unconfined client-controlled file_path in upload_attachment functions, letting remote attackers with write-tool access disclose server files and sensitive data, exploit requires write-tool access.

  • 7.4 /10 High
    CVE-2026-73494

    Blaze - Authorization Bypass & Cache Poisoning

    Blaze Scala library < 0.23.18 and 1.0.0-M1 to < 1.0.0-M42 contains an HTTP/1.1 parsing vulnerability caused by lax header and request boundary validation in Http1ServerParser, letting attackers cause authorization bypass or cache poisoning, exploit requires a pair of disagreeing parsers.

  • 9.8 /10 Critical
    CVE-2026-73470 No auth

    Apache Syncope - Improper Privilege Management

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an improper privilege management vulnerability caused by delegation of roles outside the user's ownership or realm subtree, letting attackers escalate privileges, exploit requires delegation management permissions.

  • 9.8 /10 Critical
    CVE-2026-73370 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by incomplete delegated administration security checks in the Reconciliation service's pull and push, letting administrators without adequate entitlements perform unauthorized actions, exploit requires attacker to be an authenticated administrator.

  • 7.5 /10 High
    CVE-2026-73236 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper realm prefix matching in delegated administration, letting attackers gain unauthorized access, exploit requires crafted realm names.

  • 7.3 /10 High
    CVE-2026-73195 Auth required

    Apache Syncope - CSV Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a CSV injection caused by improper encoding or escaping of output in CSV export, letting authenticated users execute spreadsheet formulas, exploit requires user authentication.

  • 7.5 /10 High
    CVE-2026-73178 No auth

    Apache Syncope - Information Disclosure & Privilege Escalation

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure vulnerability caused by administrator access to signed JWT access tokens via REST, letting administrators impersonate higher privileged users, exploit requires administrator entitlements.

  • 8.8 /10 High
    CVE-2026-72524 Auth required

    Apache Doris - Broken Access Control

    Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3 contain a broken access control vulnerability caused by incorrect authorization logic, letting authenticated users bypass privilege checks to access or modify unauthorized data, exploit requires user authentication.

  • 7.4 /10 High
    CVE-2026-70658

    Pay - Authentication Bypass

    Pay for Ruby on Rails < 11.6.2 contains a timing attack vulnerability caused by insecure comparison of HMAC signatures in PaddleBillingController, letting unauthenticated remote attackers forge accepted webhooks, exploit requires precise timing measurements.