Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 406 of 695

  • 9.8 /10 Critical
    CVE-2026-82331 No auth

    Apache BuildStream - Path Traversal

    Apache BuildStream < 2.8.1 on Python < 3.12 contains a file write vulnerability caused by improper link resolution in the tar source plugin, letting attackers write files via symlinks during source fetching, exploit requires malicious source tarballs.

  • 8.8 /10 High
    CVE-2026-81537 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper input handling, letting remote authenticated attackers execute arbitrary OS commands.

  • 7.7 /10 High
    CVE-2026-81536 Auth required

    IBM DataStage - XML External Entity Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML external entity injection caused by improper XML input handling, letting remote authenticated attackers obtain sensitive information, exploit requires authentication.

  • 7.7 /10 High
    CVE-2026-81208 Auth required

    IBM DataStage on Cloud Pak for Data - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by improper handling of encrypted credentials, letting authenticated users access sensitive credentials of others, exploit requires user authentication.

  • 8.8 /10 High
    CVE-2026-80425 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 8.8 /10 High
    CVE-2026-80423 Auth required

    IBM DataStage - Information Disclosure

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by exposure of namespace-wide secrets via accessible file mounts, letting remote authenticated attackers obtain sensitive information.

  • 8.8 /10 High
    CVE-2026-80412 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper escaping of connector property values during OSH script generation, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-80379 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 7.5 /10 High
    CVE-2026-79677 No auth

    Apache Tomcat - Denial of Service

    Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain a denial of service caused by missing resource release and incorrect timeout comparison in asynchronous WebSocket writes, letting attackers cause service disruption, exploit requires network access.

  • 8.5 /10 High
    CVE-2026-79310

    webpy web.py - Server-Side Template Injection

    webpy web.py 0.76 contains a server-side template injection caused by sandbox bypass in precompiled template loader, letting attackers execute arbitrary Python code and OS commands remotely, exploit requires attacker to write to template directory.

  • 7.3 /10 High
    CVE-2026-78437

    Apache Tomcat - Denial of Service

    Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 contain an incomplete cleanup vulnerability caused by malformed requests, letting attackers cause requests from other users to fail, exploit requires timing conditions.

  • 7.5 /10 High
    CVE-2026-78383 No auth

    Apache Tomcat - Denial of Service

    Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain a denial of service caused by allocation of resources without limits in AJP processing threads, letting unauthenticated attackers pin threads and exhaust resources, exploit requires unauthenticated AJP request.

  • 7.5 /10 High
    CVE-2026-77791 No auth

    Apache Tomcat - Denial of Service

    Apache Tomcat 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, and 9.0.74 through 9.0.121 contain a denial of service caused by uncontrolled resource consumption during WebSocket close message handling, letting attackers cause service disruption, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-77762 No auth

    Apache Tomcat - Race Condition

    Apache Tomcat 8.5.59 through 8.5.100, 9.0.39 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25 contain a race condition caused by improper synchronization in HTTP/2 request handling, letting attackers inject trailer fields into other HTTP/2 requests, exploit requires crafted HTTP/2 requests.

  • 9.9 /10 Critical
    CVE-2026-77602 Auth required

    OpenC3 COSMOS - Remote Code Execution

    OpenC3 COSMOS 5.1.0 to 7.3.0 contains a remote code execution caused by authenticated non-administrator users writing executable content under targets_modified/, letting attackers execute arbitrary code with elevated privileges, exploit requires authenticated non-admin user access.