Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 425 of 695

  • 9.1 /10 Critical
    CVE-2026-17645 Auth required

    IBM Financial Transaction Manager - Privilege Escalation

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a privilege escalation caused by improper privilege management, letting remote authenticated attackers gain elevated privileges.

  • 8.8 /10 High
    CVE-2026-17644 Auth required

    IBM Financial Transaction Manager - Hardcoded Credentials

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a hardcoded credentials vulnerability caused by embedded static credentials, letting local attackers gain unauthorized access and modify transaction data, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-17643 Auth required

    IBM Financial Transaction Manager - Authentication Bypass

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken authentication caused by insufficiently protected credentials, letting local attackers obtain sensitive information and perform unauthorized actions, exploit requires local access.

  • 8.8 /10 High
    CVE-2026-17637

    IBM Financial Transaction Manager - Remote Code Execution

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting adjacent-network attackers execute arbitrary code remotely, exploit requires network adjacency.

  • 8.8 /10 High
    CVE-2026-17636 Auth required

    IBM Financial Transaction Manager (FTM) - Remote Code Execution

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a remote code execution caused by improper validation of a specified quantity, letting remote authenticated attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-17635 No auth

    IBM Financial Transaction Manager - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control caused by improper configuration of HTTP method-based security constraints, letting remote attackers perform unauthorized actions, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-17618 No auth

    IBM Financial Transaction Manager - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an improper authorization vulnerability, letting remote unauthenticated attackers view and modify sensitive information and cause denial of service, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-17472 Auth required

    IBM Concert - Broken Access Control

    IBM Concert 1.0.0 through 3.0.0 contains a broken access control caused by use of wildcards in RBAC permission definitions, letting remote authenticated attackers access or modify unauthorized resources.

  • 8.8 /10 High
    CVE-2026-17102 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 8.8 /10 High
    CVE-2026-16672 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.8 /10 High
    CVE-2026-16469 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 8.8 /10 High
    CVE-2026-16468 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper input handling, letting remote authenticated attackers execute arbitrary OS commands.

  • 9.9 /10 Critical
    CVE-2026-16346 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 9.8 /10 Critical
    CVE-2026-13355 PoC publicNo auth

    Meta Box AIO - Privilege Escalation

    Meta Box AIO plugin for WordPress <= 3.11.0 contains a privilege escalation caused by lack of authorization checks in populate_via_query_string() and improper role validation in mb-user-profile component, letting unauthenticated attackers escalate to Administrator via crafted shortcode injection.

  • 9.8 /10 Critical
    CVE-2026-12718 No auth

    Karel Electronic Industry and Trade Inc. KarelIPS - SQL Injection

    Karel Electronic Industry and Trade Inc. KarelIPS <= 22092026 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.