Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 151 of 681

  • 8.3 /10 High
    CVE-2026-84315 Auth required

    Nginx UI - Broken Access Control

    Nginx UI < 2.4.1 contains a broken access control caused by missing RequireSecureSession enforcement on multiple authenticated mutation routes, letting attackers with stolen authenticated sessions bypass OTP/passkey step-up to modify sensitive settings.

  • 8.7 /10 High
    CVE-2026-84314 Auth required

    Nginx UI - Broken Access Control

    Nginx UI < 2.4.1 contains a broken access control vulnerability caused by missing RequireSecureSession enforcement in POST /api/users/:id endpoint, letting authenticated users change other users' passwords, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-84313 Auth required

    Nginx UI - Authentication Bypass

    Nginx UI < 2.4.1 contains a broken authentication caused by missing password verification in POST /api/otp_enroll and /api/finish_passkey_register endpoints, letting attackers with stolen JWT bind attacker-controlled TOTP or passkey, exploit requires valid JWT token.

  • 7.1 /10 High
    CVE-2026-84312 No auth

    Nginx UI - Authentication Bypass

    Nginx UI < 2.4.1 contains an authentication bypass caused by improper OAuth state validation in GetCasdoorUri and CasdoorCallback, letting unauthenticated attackers mint sessions for arbitrary identities, exploit requires victim browser interaction.

  • 7.4 /10 High
    CVE-2026-83535 No auth

    OpenStack openstack-network-exporter - Authentication Bypass

    OpenStack openstack-network-exporter contains an information disclosure vulnerability caused by misconfigured or omitted TLS in user authentication, letting adjacent network attackers access sensitive OVS and OVN dataplane metrics without credentials.

  • 9.6 /10 Critical
    CVE-2026-82110 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of pathname, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-82108 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 9.6 /10 Critical
    CVE-2026-82103 Auth required

    IBM DataStage - Information Disclosure

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by exposure of sensitive information, letting remote authenticated attackers obtain sensitive data, exploit requires authentication.

  • 9.6 /10 Critical
    CVE-2026-82101 Auth required

    IBM DataStage on Cloud Pak for Data - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper input validation, letting remote authenticated attackers cause denial of service, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-82096 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 7.5 /10 High
    CVE-2026-78673 No auth

    IBM Maximo AI Service - Denial of Service

    IBM Maximo AI Service 9.1.0 and 9.2.0 contain a denial of service caused by improper input validation, letting remote attackers cause service disruption, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-78357 No auth

    OTRS - Authentication Bypass

    OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and < 2026.7.X contain an authentication token invalidation flaw caused by delayed JWT revocation after user deactivation or password change, letting attackers with previously obtained tokens maintain access until token expiration, exploit requires possession of a valid token.

  • 8.7 /10 High
    CVE-2026-78355 Auth required

    OTRS - Path Traversal

    OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X contain a path traversal caused by improper validation in SendSupportBundle functionality, letting authenticated administrators delete files outside intended directories, exploit requires administrative access.

  • 9.9 /10 Critical
    CVE-2026-77366 Auth required

    obsidian-tc - Broken Access Control

    obsidian-tc < 1.3.1 contains a broken access control vulnerability caused by lack of vault claim in JWT and global folder access-control list, letting attackers with valid tokens read, write, or delete contents of other vaults, exploit requires valid token.

  • 8.8 /10 High
    CVE-2026-77363 No auth

    obsidian-tc - CORS Misconfiguration & Information Disclosure

    obsidian-tc prior to 1.3.1 contains a CORS misconfiguration caused by lack of Host and Origin header validation and missing DNS-rebinding protection in Streamable HTTP transport, letting malicious web pages access local MCP endpoints and vaults when auth.mode is none, exploit requires loopback configuration with auth.mode set to none.