Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 287 of 767

  • 7.1 /10 High
    CVE-2026-40804 No auth

    Kodezen LLC aBlocks - Reflected XSS

    Kodezen LLC aBlocks <= 2.16.0 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires crafted input.

  • 8.1 /10 High
    CVE-2026-19494 Auth required

    IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote authenticated attackers bypass security restrictions.

  • 7.5 /10 High
    CVE-2026-19493 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Path Traversal

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a path traversal vulnerability caused by improper input validation, letting remote attackers perform arbitrary file write.

  • 9.1 /10 Critical
    CVE-2026-19491 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote attackers bypass authentication, exploit requires network access.

  • 8.8 /10 High
    CVE-2026-19482 Auth required

    IBM Security Verify Access & IBM Verify Identity Access - Command Injection

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a command injection caused by improper neutralization of command arguments, letting remote authenticated attackers execute arbitrary commands.

  • 9.1 /10 Critical
    CVE-2026-19218 No auth

    AKIN Software MyRezzta - Broken Authentication

    AKIN Software MyRezzta 2.06.03 before 2.07.01 contains a weak password recovery mechanism caused by insecure password reset process, letting attackers exploit password recovery to gain unauthorized access, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-19083 Auth required

    AKIN Software OctoCloud - Authorization Bypass

    AKIN Software OctoCloud >= 1.12.06 < 1.12.07 contains an authorization bypass caused by user-controlled key vulnerability, letting attackers access functionality not properly constrained by ACLs, exploit requires crafted requests.

  • 8.8 /10 High
    CVE-2026-18740 Auth required

    IBM Security Verify Access & IBM Verify Identity Access - Broken Access Control

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an argument injection vulnerability in unspecified components, letting remote authenticated attackers perform unauthorized actions.

  • 9.1 /10 Critical
    CVE-2026-17609 No auth

    WordPress Super Forms – Drag & Drop Form Builder - Arbitrary Directory Deletion

    Super Forms – Drag & Drop Form Builder plugin for WordPress <= 6.3.316 contains an arbitrary directory deletion vulnerability caused by insufficient validation of JSON field declarations and a bypassable ABSPATH guard in submit_form, letting unauthenticated attackers recursively delete arbitrary directories, exploit requires 'Delete files from server after form submissions' setting enabled by admin.

  • 8.8 /10 High
    CVE-2026-17196 Auth required

    Super Forms – Drag & Drop Form Builder - Unrestricted File Upload

    Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains an unrestricted file type upload caused by missing file type validation in upload_files function, letting authenticated attackers with Subscriber-level access upload executable files, exploit requires poisoning _super_elements post meta via super_save_form AJAX handler.

  • 8.2 /10 High
    CVE-2026-17189 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Stored XSS

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a stored XSS vulnerability caused by improper input sanitization in the Web UI, letting unauthenticated attackers embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session.

  • 9.1 /10 Critical
    CVE-2026-16916 Auth required

    IBM Security Verify Access - Remote Code Execution

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a remote code execution caused by a protection mechanism failure, letting remote authenticated attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-16823 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a broken authentication caused by improper authentication, letting remote attackers bypass security restrictions, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-16340 No auth

    IBM DataPower Gateway - Remote Code Execution

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by an out-of-bounds write in the RFC2047 encoded-word parser, letting remote attackers execute arbitrary code, exploit requires network access.

  • 7.4 /10 High
    CVE-2026-16181 No auth

    IBM DataPower Gateway - Broken Access Control

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a broken access control vulnerability caused by improper authorization, letting remote attackers bypass security restrictions, exploit requires network access.