Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 505 of 681

  • 7.5 /10 High
    CVE-2026-87289 No auth

    Oracle Fusion Middleware Helidon - Denial of Service

    Oracle Fusion Middleware Helidon 4.0.0-4.5.4 contains a denial of service caused by improper handling in helidon-webserver-static-content, letting unauthenticated attackers with network access via HTTP cause service hang or crash, exploit requires network access.

  • 8.1 /10 High
    CVE-2026-87288 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM 25.0.4.1 contains a remote code execution caused by a vulnerability in the Compiler component, letting unauthenticated attackers with network access via HTTP take over the system, exploit requires high attack complexity.

  • 8.1 /10 High
    CVE-2026-87287 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM 25.0.4.1 contains a remote code execution vulnerability caused by an unspecified issue in the Compiler component, letting unauthenticated network attackers take over the system, exploit requires high attack complexity.

  • 8.1 /10 High
    CVE-2026-87286 No auth

    Oracle GraalVM - Remote Code Execution

    Oracle GraalVM 25.0.4.1 contains a remote code execution vulnerability caused by an unspecified issue in the Compiler component, letting unauthenticated network attackers take over the system, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-87277

    Oracle VM VirtualBox - Denial of Service

    Oracle VM VirtualBox 7.2.16 contains a denial of service caused by improper handling in the Core component, letting unauthenticated attackers with network access via RDP cause a hang or crash, exploit requires network access via RDP.

  • 7.5 /10 High
    CVE-2026-87276 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 contains a privilege escalation vulnerability caused by a core component flaw, letting low privileged logged-in attackers with user interaction takeover the system, exploit requires user interaction from a different person.

  • 8.6 /10 High
    CVE-2026-87273 No auth

    Oracle VM VirtualBox - Remote Code Execution

    Oracle VM VirtualBox 7.2.16 contains a remote code execution caused by a vulnerability in the core component, letting unauthenticated attackers with infrastructure logon and user interaction take over the system, exploit requires user interaction from a different person.

  • 7.8 /10 High
    CVE-2026-87272 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over Oracle VM VirtualBox, exploit requires attacker login.

  • 7.8 /10 High
    CVE-2026-87271 Auth required

    Oracle VM VirtualBox - Complete System Takeover

    Oracle VM VirtualBox 7.2.16 on Windows hosts contains a vulnerability in the Core component, letting low privileged logged-in attackers fully compromise the system, exploit requires attacker logon to the host.

  • 7.8 /10 High
    CVE-2026-87270 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 on Windows hosts contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over the VirtualBox environment, exploit requires local login.

  • 7.8 /10 High
    CVE-2026-87269 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 on Windows hosts contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over the VirtualBox environment, exploit requires local login.

  • 7.8 /10 High
    CVE-2026-87268 Auth required

    Oracle VM VirtualBox - Privilege Escalation

    Oracle VM VirtualBox 7.2.16 on Windows hosts contains a privilege escalation vulnerability in the Core component, letting low privileged logged-in attackers take over the system, exploit requires local access.

  • 8.2 /10 High
    CVE-2026-87266 No auth

    Oracle Agile PLM - Broken Access Control

    Oracle Agile PLM 9.3.6 contains an unauthorized access and partial denial of service vulnerability caused by insufficient access control in Application Server, letting unauthenticated attackers with network access via HTTP compromise critical data and cause partial DoS.

  • 8.1 /10 High
    CVE-2026-87265 Auth required

    Oracle E-Business Suite Oracle Purchasing - Broken Access Control

    Oracle E-Business Suite Oracle Purchasing 12.2.3-12.2.15 contains an unauthorized data access and modification vulnerability caused by insufficient access controls, letting low privileged attackers with network access via HTTP modify or access critical data.

  • 7.7 /10 High
    CVE-2026-87264 Auth required

    Oracle PeopleSoft PeopleTools - Broken Access Control

    Oracle PeopleSoft PeopleTools 8.61-8.63 contains an integrity-impacting vulnerability in Integration Broker, letting low privileged attackers with network HTTP access modify critical data, exploit requires low privilege network access.