Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 514 of 681

  • 7.5 /10 High
    CVE-2026-87136 No auth

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an unauthorized access vulnerability in Access and security component, letting unauthenticated network attackers access critical or all accessible data via HTTP, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-87135 Auth required

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an unauthorized access vulnerability caused by insufficient access control in Access and security component, letting low privileged attackers with network access via HTTP access and modify critical data.

  • 7.7 /10 High
    CVE-2026-87134 Auth required

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an unauthorized access vulnerability caused by insufficient access controls in Access and security component, letting low privileged attackers with network access via TCP gain unauthorized access to critical data, exploit requires low privileged network access.

  • 7.6 /10 High
    CVE-2026-87133 Auth required

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting high privileged attackers with network access via HTTP gain unauthorized access and modify critical data, exploit requires high privileges.

  • 7.6 /10 High
    CVE-2026-87132 Auth required

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting low privileged attackers with network access via HTTP and user interaction gain unauthorized access and modify data, exploit requires user interaction from a different person.

  • 7.6 /10 High
    CVE-2026-87131 Auth required

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting low privileged attackers with network access via HTTP and user interaction gain unauthorized access and modify data, exploit requires user interaction from a different person.

  • 7.4 /10 High
    CVE-2026-87130 No auth

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security component, letting unauthenticated attackers with network access via SMTP create, delete, or modify critical data, exploit requires network access via SMTP with high complexity.

  • 9.1 /10 Critical
    CVE-2026-87129 No auth

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-87128 No auth

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 7.7 /10 High
    CVE-2026-87127 Auth required

    Oracle Purchasing - Information Disclosure

    Oracle Purchasing 12.2.10-12.2.15 contains an information disclosure vulnerability caused by improper access control in G-Invoicing component, letting low privileged attackers with network access via HTTP gain unauthorized access to critical data, exploit requires low privileged network access.

  • 7.1 /10 High
    CVE-2026-87126 Auth required

    Oracle Oracle Report Manager - Broken Access Control

    Oracle E-Business Suite Oracle Report Manager 12.2.3-12.2.15 contains an unauthorized access vulnerability in Reports Security, letting low privileged attackers with network access via HTTP access critical data and cause partial denial of service, exploit requires low privileged network access.

  • 8.3 /10 High
    CVE-2026-87125 Auth required

    Oracle Financials for Asia/Pacific - Broken Access Control

    Oracle Financials for Asia/Pacific 12.2.8-12.2.15 contains a broken access control vulnerability caused by improper authorization in Internal Operations, letting low privileged attackers with network access via HTTP create, modify, delete critical data, or cause partial denial of service.

  • 7.7 /10 High
    CVE-2026-87124 Auth required

    Oracle iRecruitment - Broken Access Control

    Oracle iRecruitment 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access control in Internal Operations, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.

  • 8.8 /10 High
    CVE-2026-85893 No auth

    Microsoft Edge - Privilege Escalation

    Microsoft Edge (Chromium-based) contains a use after free vulnerability that allows an unauthorized attacker to elevate privileges over a network, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-85234 No auth

    tftp-hpa - Denial of Service

    tftp-hpa contains an out-of-bounds read/write vulnerability caused by invalid match offsets passed to genmatchstring() in the in.tftpd remap engine when processing inverse remap rules with custom error messages, letting remote unauthenticated attackers cause denial of service.