Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 196 of 681
- 7.5 /10 HighCVE-2026-87665 No auth
Brocade Fabric OS - Denial of Service
Brocade Fabric OS < 10.0.1 contains a stack-based buffer overflow caused by processing oversized Nonce payloads in IKEv2 protocol handler on IPsec-enabled FCIP circuits, letting unauthenticated remote attackers cause denial of service via crafted UDP packets on port 500.
- 7.8 /10 HighCVE-2026-87664 Auth required
Brocade Fabric OS - Broken Access Control
Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 contain a broken access control vulnerability caused by improper verification of IPC storage callbacks in the web management daemon, letting attackers gain administrative privileges without authentication.
- 7.1 /10 HighCVE-2026-87660 Auth required
Brocade Fabric OS - Broken Access Control
Brocade Fabric OS < 9.2.2d and 10.0.0 through 10.0.0a1 contain an improper file permission and missing authorization vulnerability in the diagnostic kernel module subsystem, letting unprivileged local users disrupt storage fabric operations and invoke privileged hardware tests, exploit requires local unprivileged user access.
- 9.8 /10 CriticalCVE-2026-87659
Brocade Fabric OS - Authorization Bypass
Brocade Fabric OS < 10.0.1 contains an authorization bypass caused by crafted inband Fibre Channel vendor-unique CT management requests in Management Server, letting compromised peer switches perform administrative actions, exploit requires compromised switch connected to fabric.
- 7.8 /10 HighCVE-2026-87428 Auth required
Brocade ASCG - Broken Access Control
Brocade ASCG < 3.5.0 contains an information disclosure caused by unauthorized local user access to SANnav host network namespace, letting attackers extract stored management credentials, exploit requires local access to ASCG VM.
- 8.8 /10 HighCVE-2026-87424 No auth
Brocade ASCG - Authentication Bypass
Brocade ASCG < 3.5.0 contains a broken authentication caused by use of a hard coded cryptographic key in SupportLink API authentication, letting attackers bypass authentication across deployments, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-85490 No auth
Brocade ASCG - Path Traversal
Brocade ASCG < 3.5.0 contains a path traversal vulnerability caused by improper sanitization of archive entries in support bundle processing, letting unauthenticated remote attackers write arbitrary files and potentially execute code, exploit requires sending or intercepting archive files.
- 8.8 /10 HighCVE-2026-85489 No auth
Brocade ASCG - Broken Access Control
Brocade ASCG < 3.5.0 contains a broken authentication caused by unauthenticated direct API access in the administrative management service, letting unauthenticated attackers perform privileged actions including data access and modification.
- 7.8 /10 HighCVE-2026-85488 Auth required
Brocade ASCG - Authentication Bypass
Brocade ASCG < 3.5.0 contains a hardcoded default password caused by embedded credentials in a distributed script, letting local authenticated users with read access escalate privileges, exploit requires default configuration.
- 8.8 /10 HighCVE-2026-85487 No auth
Brocade ASCG - Path Traversal
Brocade ASCG < 3.5.0 contains a path traversal caused by insufficient path restriction validation in HTTP service component, letting unauthenticated local network attackers read, write, or delete arbitrary files, exploit requires local network access.
- 8.0 /10 HighCVE-2026-85486 Auth required
Brocade ASCG - Command Injection
Brocade ASCG < 3.5.0 contains a command injection caused by improper processing of user input in configuration forms before validation, letting authenticated users execute arbitrary code on the server, exploit requires authentication.
- 8.8 /10 HighCVE-2026-85423 No auth
Brocade ASCG - Command Injection
Brocade ASCG < 3.5.0 contains a command injection caused by lack of authentication and authorization checks in the data collection service API, letting attackers with network access execute arbitrary system commands remotely, exploit requires network access.
- 7.8 /10 HighCVE-2026-85422
Brocade ASCG - Hardcoded Credentials
Brocade ASCG < 3.5.0 contains a hardcoded cryptographic key vulnerability caused by static keys embedded in software binaries, letting attackers decrypt stored credentials and forge administrative messages, exploit requires access to software binaries.
- 8.8 /10 HighCVE-2026-85421 No auth
Brocade ASCG - Broken Access Control
Brocade ASCG < 3.5.0 contains a broken access control vulnerability caused by improper enforcement of authentication and access control in the HTTPS service, letting unauthenticated attackers with network access issue control commands and modify system configurations, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-85097 CISA KEVPoC publicNo auth
Bricksforge WordPress - Unrestricted File Upload
Bricksforge WordPress plugin <= 3.1.8.9 contains an unrestricted file upload vulnerability caused by insufficient validation of the 'temporaryFileUploads' URL field, letting unauthenticated attackers upload and execute arbitrary PHP code.