Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 515 of 681

  • 7.3 /10 High
    CVE-2026-85013 Auth required

    environment-modules - Command Injection

    environment-modules contains a command injection caused by evaluation of maliciously named modulefiles during Bash completion of module commands, letting local attackers execute arbitrary commands, exploit requires attacker to place malicious modulefile in MODULEPATH.

  • 8.5 /10 High
    CVE-2026-83490 Auth required

    Oracle iRecruitment - Broken Access Control

    Oracle iRecruitment 12.2.3-12.2.15 contains an unauthorized access and data modification vulnerability caused by insufficient access controls in Internal Operations, letting low privileged attackers with network access via HTTP compromise critical data, exploit requires low privileged network access.

  • 7.5 /10 High
    CVE-2026-83489 Auth required

    Oracle Banking Origination - Authentication Bypass

    Oracle Banking Origination 14.5.0.0.0-14.9.0.0.0 contains a vulnerability in Onboarding Batch Processes, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges and network access.

  • 7.7 /10 High
    CVE-2026-83487 Auth required

    Oracle Product Hub - Broken Access Control

    Oracle Product Hub 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Item Catalog, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.

  • 7.7 /10 High
    CVE-2026-83486 Auth required

    Oracle Product Hub - Broken Access Control

    Oracle Product Hub 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access controls in Item Catalog, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.

  • 7.7 /10 High
    CVE-2026-83485 Auth required

    Oracle Product Hub - Broken Access Control

    Oracle Product Hub 12.2.3-12.2.15 contains an unauthorized access vulnerability caused by insufficient access control in Item Catalog, letting low privileged attackers with network access via HTTP access critical data, exploit requires low privileges.

  • 7.1 /10 High
    CVE-2026-83484 Auth required

    Oracle US Federal Human Resources - Broken Access Control

    Oracle US Federal Human Resources 12.2.3-12.2.15 contains a broken access control vulnerability caused by insufficient privilege checks in internal operations, letting low privileged attackers with network access via HTTP modify and read critical data.

  • 8.0 /10 High
    CVE-2026-83483 Auth required

    Oracle Advanced Benefits - Authentication Bypass

    Oracle Advanced Benefits 12.2.3-12.2.15 contains a takeover vulnerability caused by an unspecified issue in Self-serv What-if Analysis, letting high privileged attackers with network access via HTTP compromise the product and impact additional products, exploit requires high privileges.

  • 7.2 /10 High
    CVE-2026-83482 Auth required

    Oracle E-Business Suite Oracle Contracts - Authentication Bypass

    Oracle E-Business Suite Oracle Contracts 12.2.14-12.2.15 contains a vulnerability in Internal Operations, letting high privileged attackers with network access via HTTP take over the product, exploit requires high privileges.

  • 7.2 /10 High
    CVE-2026-83481 Auth required

    Oracle E-Business Suite Oracle Contracts - Remote Code Execution

    Oracle E-Business Suite Oracle Contracts 12.2.14-12.2.15 contains a remote code execution caused by an easily exploitable vulnerability in Internal Operations, letting high privileged attackers with network access via HTTP take over the product, exploit requires high privileges.

  • 8.8 /10 High
    CVE-2026-83479 Auth required

    Oracle E-Business Suite Oracle Contracts - Remote Code Execution

    Oracle E-Business Suite Oracle Contracts 12.2.14-12.2.15 contains a remote code execution caused by an easily exploitable vulnerability in Internal Operations, letting low privileged attackers with network access via HTTP take over the product, exploit requires low privileges.

  • 8.1 /10 High
    CVE-2026-83477

    Oracle Work in Process - Broken Access Control

    Oracle Work in Process 12.2.3-12.2.15 contains a broken access control vulnerability caused by unauthenticated attacker access to the physical communication segment, letting attackers create, delete, or modify critical data, exploit requires physical network access.

  • 8.2 /10 High
    CVE-2026-83465 No auth

    Oracle Mobile Application Server - Broken Access Control

    Oracle Mobile Application Server 12.2.3-12.2.15 contains a broken access control vulnerability caused by improper authorization in MWA Terminal Server, letting unauthenticated attackers cause denial of service and data modification, exploit requires user interaction.

  • 8.1 /10 High
    CVE-2026-83464 No auth

    Oracle Mobile Application Server - Remote Code Execution

    Oracle Mobile Application Server 12.2.3-12.2.15 contains a remote takeover vulnerability caused by an unspecified issue in MWA Terminal Server, letting unauthenticated attackers with network access compromise the server, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-83463

    Oracle Mobile Application Server - Authentication Bypass

    Oracle Mobile Application Server 12.2.3-12.2.15 contains a takeover vulnerability caused by access to the physical communication segment in MWA Terminal Server, letting unauthenticated attackers compromise the server, exploit requires physical network access.