Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 59 of 677
- 8.7 /10 HighCVE-2026-92883 Auth required
GitLab CE/EE - Stored XSS
GitLab CE/EE >= 19.1, < 19.2.8, 19.3, < 19.3.5, and 19.4, < 19.4.2 contain a stored XSS caused by improper sanitization of HTML attributes in syntax-highlighted output, letting authenticated users execute arbitrary JavaScript in other users' browser sessions via specially crafted repositories.
- 9.1 /10 CriticalCVE-2026-92464 Auth required
Adobe Commerce - Remote Code Execution
Adobe Commerce contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.
- 8.6 /10 HighCVE-2026-92088 Auth required
upKeeper Solutions upKeeper Instant Privilege Access - Privilege Escalation
upKeeper Solutions upKeeper Instant Privilege Access <= 1.7.1 contains a privilege escalation caused by improper handling of undefined values, letting attackers escalate privileges, exploit requires no special conditions.
- 9.3 /10 CriticalCVE-2026-91013 No auth
Adobe Commerce - Stored XSS
Adobe Commerce contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, potentially leading to elevated access or session control, exploit requires victim to visit the vulnerable page.
- 10.0 /10 CriticalCVE-2026-90532 No auth
Adobe Experience Manager - Broken Access Control
Adobe Experience Manager contains an incorrect authorization vulnerability caused by improper access control, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-90531 Auth required
Adobe Experience Manager - Privilege Escalation
Adobe Experience Manager contains an XML External Entity Injection (XXE) vulnerability caused by improper restriction of XML external entity references, letting low-privileged attackers escalate privileges, exploit requires no user interaction.
- 9.3 /10 CriticalCVE-2026-90530 No auth
ColdFusion RDS - Path Traversal
ColdFusion RDS contains a path traversal vulnerability caused by improper limitation of pathname to restricted directories, letting attackers read arbitrary files outside intended scope, exploit requires no user interaction.
- 10.0 /10 CriticalCVE-2026-89309
CVE-2026-89309
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
- 7.5 /10 HighCVE-2026-89201 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of device group or facility names in Bulk Export workflow, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 8.8 /10 HighCVE-2026-89199 Auth required
RUGGEDCOM CROSSBOW - Broken Access Control
RUGGEDCOM CROSSBOW < V6.0 contains a broken access control vulnerability caused by improper restriction of sensitive configuration access via database queries, letting authenticated attackers retrieve admin credentials, exploit requires authentication.
- 8.8 /10 HighCVE-2026-89198 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of firmware file names, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 8.8 /10 HighCVE-2026-89197 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of the Value field in notification conditions during Notification Profile configuration, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 8.8 /10 HighCVE-2026-89196 Auth required
RUGGEDCOM CROSSBOW - SQL Injection
RUGGEDCOM CROSSBOW < V6.0 contains a SQL injection caused by improper validation of facility names in Bulk Import/Export workflow, letting authenticated attackers with specific privileges execute arbitrary SQL commands.
- 7.1 /10 HighCVE-2026-89120 Auth required
SAP ABAP Platform - Authorization Bypass
SAP ABAP Platform contains an authorization bypass caused by a regression in session manager single transaction mode, letting low-privileged attackers bypass restrictions via crafted requests, exploit requires low privileges.
- 8.8 /10 HighCVE-2026-89113 Auth required
SAP Commerce Cloud - SQL Injection
SAP Commerce Cloud contains a SQL injection caused by insufficient validation of user-supplied input in database queries, letting authenticated users read, modify, or delete sensitive data, exploit requires authentication.