Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 198 of 681

  • 8.1 /10 High
    CVE-2026-84058 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a buffer overflow caused by improper handling of TDS PRELOGIN packets, letting remote attackers cause denial of service or execute arbitrary code, exploit requires network access to the Collector.

  • 8.1 /10 High
    CVE-2026-84057 No auth

    IBM Guardium Data Protection - Command Injection

    IBM Guardium Data Protection 12.2.2 and 12.1 contain a command injection caused by improper neutralization of special elements in OS commands, letting remote attackers execute arbitrary commands, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-84035 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a buffer overflow caused by improper handling of input, letting remote attackers execute arbitrary code remotely, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-83947 Auth required

    Azure Event Grid - Broken Access Control

    Azure Event Grid contains a broken access control caused by missing authorization, letting authorized attackers perform network spoofing, exploit requires attacker to be authorized.

  • 8.7 /10 High
    CVE-2026-83943 No auth

    Azure API Center - Information Disclosure

    Azure API Center contains an information disclosure vulnerability caused by exposure of sensitive information, letting unauthorized attackers disclose information over a network, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-82900 No auth

    IBM Guardium Data Protection - Path Traversal

    IBM Guardium Data Protection 12.2.2 and 12.1 contain a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting remote attackers delete arbitrary files, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-82895 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a buffer overflow vulnerability that allows remote attackers to execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-82627 Auth required

    Uncanny Automator WordPress - PHP Object Injection

    Uncanny Automator WordPress plugin <= 7.6.1.1 contains a PHP Object Injection caused by deserialization of untrusted input in trigger meta, letting authenticated attackers with Subscriber-level access delete arbitrary files, exploit requires third-party integration and configured recipe.

  • 8.1 /10 High
    CVE-2026-82344 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1 contains a heap-based buffer overflow caused by improper handling of TDS login fragments in S-TAP TrafficTap login reassembly, letting unauthenticated remote attackers cause denial of service or execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-82335 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, 12.2 contains a heap-based buffer overflow caused by a specially crafted MongoDB SCRAM username in the MongoDB protocol parser, letting remote attackers cause denial of service or execute arbitrary code, exploit requires crafted MongoDB SCRAM username.

  • 8.1 /10 High
    CVE-2026-82334 No auth

    IBM Guardium Data Protection - Out of Bounds Read

    IBM Guardium Data Protection 12.0, 12.1, 12.2 contains a heap-based out-of-bounds read caused by invalid offset or length values in the TDS7 LOGIN7 protocol parser, letting remote attackers cause information disclosure or denial of service, exploit requires crafted TDS LOGIN7 packets.

  • 8.6 /10 High
    CVE-2026-81932 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a SQL injection caused by improper sanitization of SQL statements, letting remote unauthenticated attackers view, add, modify, or delete database information, exploit requires crafted SQL input.

  • 9.8 /10 Critical
    CVE-2026-80381 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a sql injection caused by improper input sanitization, letting remote attackers execute unauthorized SQL statements, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-79842 No auth

    HPE Intelligent Management Center - Authentication Bypass

    HPE Intelligent Management Center (iMC) < 7.3 E0713 contains an authentication bypass caused by improper authentication checks, letting attackers gain unauthorized access, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-78669

    HTTP/2 - Denial of Service

    HTTP/2 protocol contains a denial of service vulnerability caused by excessive CPU consumption from many small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values, letting malicious peers cause resource exhaustion, exploit requires a malicious HTTP/2 peer.