Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 213 of 695

  • 7.7 /10 High
    CVE-2026-83947 Auth required

    Azure Event Grid - Broken Access Control

    Azure Event Grid contains a broken access control caused by missing authorization, letting authorized attackers perform network spoofing, exploit requires attacker to be authorized.

  • 8.7 /10 High
    CVE-2026-83943 No auth

    Azure API Center - Information Disclosure

    Azure API Center contains an information disclosure vulnerability caused by exposure of sensitive information, letting unauthorized attackers disclose information over a network, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-82900 No auth

    IBM Guardium Data Protection - Path Traversal

    IBM Guardium Data Protection 12.2.2 and 12.1 contain a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting remote attackers delete arbitrary files, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-82895 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a buffer overflow vulnerability that allows remote attackers to execute arbitrary code.

  • 7.5 /10 High
    CVE-2026-82627 Auth required

    Uncanny Automator WordPress - PHP Object Injection

    Uncanny Automator WordPress plugin <= 7.6.1.1 contains a PHP Object Injection caused by deserialization of untrusted input in trigger meta, letting authenticated attackers with Subscriber-level access delete arbitrary files, exploit requires third-party integration and configured recipe.

  • 8.1 /10 High
    CVE-2026-82344 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1 contains a heap-based buffer overflow caused by improper handling of TDS login fragments in S-TAP TrafficTap login reassembly, letting unauthenticated remote attackers cause denial of service or execute arbitrary code.

  • 8.1 /10 High
    CVE-2026-82335 No auth

    IBM Guardium Data Protection - Buffer Overflow

    IBM Guardium Data Protection 12.0, 12.1, 12.2 contains a heap-based buffer overflow caused by a specially crafted MongoDB SCRAM username in the MongoDB protocol parser, letting remote attackers cause denial of service or execute arbitrary code, exploit requires crafted MongoDB SCRAM username.

  • 8.1 /10 High
    CVE-2026-82334 No auth

    IBM Guardium Data Protection - Out of Bounds Read

    IBM Guardium Data Protection 12.0, 12.1, 12.2 contains a heap-based out-of-bounds read caused by invalid offset or length values in the TDS7 LOGIN7 protocol parser, letting remote attackers cause information disclosure or denial of service, exploit requires crafted TDS LOGIN7 packets.

  • 8.6 /10 High
    CVE-2026-81932 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a SQL injection caused by improper sanitization of SQL statements, letting remote unauthenticated attackers view, add, modify, or delete database information, exploit requires crafted SQL input.

  • 9.8 /10 Critical
    CVE-2026-80381 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a sql injection caused by improper input sanitization, letting remote attackers execute unauthorized SQL statements, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-79842 No auth

    HPE Intelligent Management Center - Authentication Bypass

    HPE Intelligent Management Center (iMC) < 7.3 E0713 contains an authentication bypass caused by improper authentication checks, letting attackers gain unauthorized access, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-78669

    HTTP/2 - Denial of Service

    HTTP/2 protocol contains a denial of service vulnerability caused by excessive CPU consumption from many small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values, letting malicious peers cause resource exhaustion, exploit requires a malicious HTTP/2 peer.

  • 7.5 /10 High
    CVE-2026-78667 No auth

    Go HTTP Server - Denial of Service

    FileServer, ServeContent, and ServeFile in Go HTTP server contain a denial of service caused by excessive CPU consumption when parsing Range headers with many small ranges, letting remote attackers cause resource exhaustion, exploit requires crafted Range header.

  • 9.1 /10 Critical
    CVE-2026-78663 No auth

    HTTP/2 Server - Denial of Service

    HTTP/2 server contains a flow control bypass caused by double refunding connection-level flow control for the same data, letting malicious clients bypass connection-level flow control limits, exploit requires malicious client to reset streams.

  • 7.5 /10 High
    CVE-2026-78660 No auth

    HTTP/2 Reverse Proxy - HTTP Request Smuggling

    An HTTP/2 implementation in a reverse proxy forwards malformed framing-related headers to HTTP/1 clients, causing HTTP request smuggling when the HTTP/1 client is not strict, letting attackers smuggle requests.