Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 211 of 695

  • 9.8 /10 Critical
    CVE-2026-87659

    Brocade Fabric OS - Authorization Bypass

    Brocade Fabric OS < 10.0.1 contains an authorization bypass caused by crafted inband Fibre Channel vendor-unique CT management requests in Management Server, letting compromised peer switches perform administrative actions, exploit requires compromised switch connected to fabric.

  • 7.8 /10 High
    CVE-2026-87428 Auth required

    Brocade ASCG - Broken Access Control

    Brocade ASCG < 3.5.0 contains an information disclosure caused by unauthorized local user access to SANnav host network namespace, letting attackers extract stored management credentials, exploit requires local access to ASCG VM.

  • 8.8 /10 High
    CVE-2026-87424 No auth

    Brocade ASCG - Authentication Bypass

    Brocade ASCG < 3.5.0 contains a broken authentication caused by use of a hard coded cryptographic key in SupportLink API authentication, letting attackers bypass authentication across deployments, exploit requires no special conditions.

  • 8.8 /10 High
    CVE-2026-85490 No auth

    Brocade ASCG - Path Traversal

    Brocade ASCG < 3.5.0 contains a path traversal vulnerability caused by improper sanitization of archive entries in support bundle processing, letting unauthenticated remote attackers write arbitrary files and potentially execute code, exploit requires sending or intercepting archive files.

  • 8.8 /10 High
    CVE-2026-85489 No auth

    Brocade ASCG - Broken Access Control

    Brocade ASCG < 3.5.0 contains a broken authentication caused by unauthenticated direct API access in the administrative management service, letting unauthenticated attackers perform privileged actions including data access and modification.

  • 7.8 /10 High
    CVE-2026-85488 Auth required

    Brocade ASCG - Authentication Bypass

    Brocade ASCG < 3.5.0 contains a hardcoded default password caused by embedded credentials in a distributed script, letting local authenticated users with read access escalate privileges, exploit requires default configuration.

  • 8.8 /10 High
    CVE-2026-85487 No auth

    Brocade ASCG - Path Traversal

    Brocade ASCG < 3.5.0 contains a path traversal caused by insufficient path restriction validation in HTTP service component, letting unauthenticated local network attackers read, write, or delete arbitrary files, exploit requires local network access.

  • 8.0 /10 High
    CVE-2026-85486 Auth required

    Brocade ASCG - Command Injection

    Brocade ASCG < 3.5.0 contains a command injection caused by improper processing of user input in configuration forms before validation, letting authenticated users execute arbitrary code on the server, exploit requires authentication.

  • 8.8 /10 High
    CVE-2026-85423 No auth

    Brocade ASCG - Command Injection

    Brocade ASCG < 3.5.0 contains a command injection caused by lack of authentication and authorization checks in the data collection service API, letting attackers with network access execute arbitrary system commands remotely, exploit requires network access.

  • 7.8 /10 High
    CVE-2026-85422

    Brocade ASCG - Hardcoded Credentials

    Brocade ASCG < 3.5.0 contains a hardcoded cryptographic key vulnerability caused by static keys embedded in software binaries, letting attackers decrypt stored credentials and forge administrative messages, exploit requires access to software binaries.

  • 8.8 /10 High
    CVE-2026-85421 No auth

    Brocade ASCG - Broken Access Control

    Brocade ASCG < 3.5.0 contains a broken access control vulnerability caused by improper enforcement of authentication and access control in the HTTPS service, letting unauthenticated attackers with network access issue control commands and modify system configurations, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-85097 CISA KEVPoC publicNo auth

    Bricksforge WordPress - Unrestricted File Upload

    Bricksforge WordPress plugin <= 3.1.8.9 contains an unrestricted file upload vulnerability caused by insufficient validation of the 'temporaryFileUploads' URL field, letting unauthenticated attackers upload and execute arbitrary PHP code.

  • 7.5 /10 High
    CVE-2026-84875 Auth required

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a buffer overflow vulnerability that allows remote attackers to execute arbitrary code, exploit requires network access.

  • 7.2 /10 High
    CVE-2026-84278 Auth required

    IBM Guardium Data Protection - Command Injection

    IBM Guardium Data Protection 12.2 contains a command injection caused by attacker-controlled arguments in the SUID-root ssh_config_wrapper component, letting authenticated high-privileged users execute commands as root.

  • 7.5 /10 High
    CVE-2026-84276

    IBM Guardium Data Protection - Denial of Service

    IBM Guardium Data Protection 12.2.2 contains a denial-of-service vulnerability caused by malformed task data triggering unchecked type assertion in edge-controller gRPC service, letting unauthenticated remote attackers cause process termination, exploit requires network access to gRPC service.