Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 778 of 891

  • 7.5 /10 High
    CVE-2026-78336 No auth

    Apache Syncope - Information Disclosure

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an information disclosure caused by returning OIDC provider configurations including client secrets to any authenticated user, letting attackers access sensitive configuration data, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-78330 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect privilege assignment vulnerability caused by disclosure of JWKS settings in internal JWT authentication, letting attackers escalate to admin privileges after authentication, exploit requires valid low-privilege JWT.

  • 9.1 /10 Critical
    CVE-2026-78299 No auth

    Eclipse Embedded CDT - Unrestricted File Upload

    Eclipse Embedded CDT 6.0 to 6.7 contains an unrestricted file write vulnerability caused by extraction of a compromised CMSIS pack archive, letting attackers write arbitrary files outside intended directories, exploit requires crafted CMSIS pack.

  • 9.8 /10 Critical
    CVE-2026-77181 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper entitlement checks on ClientApp update operations, letting administrators perform unauthorized actions, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-77051 No auth

    Apache Syncope - SQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized entityKey and opEvent parameters, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-76461 CISA KEVPoC publicNo auth

    Cisco AsyncOS Software for Cisco Secure Email Gateway - Command Injection

    Cisco AsyncOS Software for Cisco Secure Email Gateway contains a command injection caused by insufficient validation in email parsing logic, letting unauthenticated remote attackers execute arbitrary commands with root privileges, exploit requires sending crafted email messages.

  • 9.8 /10 Critical
    CVE-2026-76443

    CVE-2026-76443

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.

  • 7.5 /10 High
    CVE-2026-76442

    CVE-2026-76442

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76442 are related to issues with improper validation of specified quantity in input that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-1284.

  • 9.8 /10 Critical
    CVE-2026-76441 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Broken Access Control

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain an improper access control vulnerability caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76440 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Path Traversal

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain path traversal vulnerabilities caused by improper input validation, letting attackers access unauthorized files, exploit requires crafted requests.

  • 9.8 /10 Critical
    CVE-2026-75030 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a missing authorization vulnerability caused by insufficient group administration checks, letting administrators with task execution entitlements mass (de)provision group members beyond their privileges, exploit requires administrator with task execution entitlements.

  • 9.8 /10 Critical
    CVE-2026-73668 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by inadequate realm access control in REST API, letting administrators read confidential connector configurations from other realms, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-73579 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by an empty Realms filter in non-recursive search requests, letting attackers bypass permission restrictions, exploit requires crafted non-recursive search requests.

  • 7.7 /10 High
    CVE-2026-73496 Auth required

    MCP Atlassian - Path Traversal

    MCP Atlassian < 0.22.0 contains a path traversal caused by unconfined client-controlled file_path in upload_attachment functions, letting remote attackers with write-tool access disclose server files and sensitive data, exploit requires write-tool access.

  • 7.4 /10 High
    CVE-2026-73494

    Blaze - Authorization Bypass & Cache Poisoning

    Blaze Scala library < 0.23.18 and 1.0.0-M1 to < 1.0.0-M42 contains an HTTP/1.1 parsing vulnerability caused by lax header and request boundary validation in Http1ServerParser, letting attackers cause authorization bypass or cache poisoning, exploit requires a pair of disagreeing parsers.