Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 217 of 695

  • 8.2 /10 High
    CVE-2026-15824 No auth

    IBM DataPower Gateway - Denial of Service

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a denial of service caused by a heap-based buffer overflow, letting remote attackers crash the system, exploit requires network access.

  • 7.5 /10 High
    CVE-2026-15822 No auth

    IBM DataPower Gateway - Denial of Service

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a denial of service caused by improper memoization of GraphQL fragment spreads, letting remote attackers cause service disruption, exploit requires crafted GraphQL queries.

  • 7.5 /10 High
    CVE-2026-15819 No auth

    IBM DataPower Gateway - Denial of Service

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a denial of service caused by out-of-bounds memory access due to strict-weak-ordering violation in a sorting comparator, letting remote attackers cause service disruption, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-15784 No auth

    IBM DataPower Gateway - Buffer Overflow

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by an out-of-bounds write, letting remote attackers execute arbitrary code remotely, exploit requires network access.

  • 8.0 /10 High
    CVE-2026-15781 Auth required

    IBM DataPower Gateway - Buffer Overflow

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow in an unspecified component, letting remote authenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-15762 No auth

    IBM DataPower Gateway - Remote Code Execution

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by an out-of-bounds write, letting remote attackers execute arbitrary code remotely, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-14999 No auth

    IBM DataPower Gateway - Authentication Bypass

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain an authentication bypass caused by improper verification of cryptographic JSON Web Signatures, letting remote attackers bypass authentication, exploit requires valid forged JSON Web Signatures.

  • 9.8 /10 Critical
    CVE-2026-14992 No auth

    IBM DataPower Gateway - Buffer Overflow

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by improper handling of input, letting attackers potentially execute arbitrary code, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-14991 No auth

    IBM DataPower Gateway - Buffer Overflow

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contains a buffer overflow caused by improper bounds checking, letting local users execute arbitrary code, exploit requires local access.

  • 9.3 /10 Critical
    CVE-2026-14990 No auth

    IBM DataPower Gateway - Stored XSS

    IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 contains a stored XSS caused by improper input sanitization in the Web UI, letting unauthenticated attackers execute arbitrary JavaScript and potentially disclose credentials within a trusted session.

  • 8.2 /10 High
    CVE-2026-14905 No auth

    IBM DataPower Gateway - XML External Entity Injection

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or cause memory resource consumption, exploit requires sending crafted XML data.

  • 8.1 /10 High
    CVE-2026-14888 No auth

    IBM DataPower Gateway - Remote Code Execution

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by a heap-based buffer overflow, letting remote attackers execute arbitrary code remotely, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-14507 Auth required

    IBM DataPower Gateway - Denial of Service

    IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 contains a denial of service caused by improper memory allocation during key derivation, letting remote authenticated attackers cause service disruption.

  • 9.8 /10 Critical
    CVE-2026-14502 No auth

    IBM DataPower Gateway - Authentication Bypass

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a broken authentication caused by failure to reject empty passwords during LDAP authentication, letting remote attackers obtain administrative access, exploit requires LDAP authentication.

  • 8.1 /10 High
    CVE-2026-14497 Auth required

    IBM DataPower Gateway - Authentication Bypass

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a broken authentication caused by improper verification of cryptographic signatures, letting remote authenticated attackers bypass security restrictions.