Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 524 of 681

  • 8.8 /10 High
    CVE-2026-83271 Auth required

    Oracle Database Server - Remote Code Execution

    Oracle Database Server 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 contain a remote code execution caused by improper privilege validation in DBMS_REDEFINITION, letting low privileged attackers with Execute privilege on DBMS_REDEFINITION compromise the RDBMS remotely, exploit requires Execute privilege on DBMS_REDEFINITION.

  • 7.5 /10 High
    CVE-2026-83270 No auth

    Oracle Business Intelligence Enterprise Edition - Broken Access Control

    Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 contains an unauthorized access vulnerability caused by insufficient access controls in BI Platform Security, letting unauthenticated attackers with network access via HTTP access critical or all accessible data, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83269 No auth

    Oracle BI Publisher - Remote Code Execution

    Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-83268 Auth required

    Oracle BI Publisher - Authentication Bypass

    Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contain a critical vulnerability in BI Platform Security, letting high privileged attackers with network access via HTTP take over the system, exploit requires high privileges.

  • 8.5 /10 High
    CVE-2026-83267 Auth required

    Oracle BI Publisher - Broken Access Control

    Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contain an unauthorized access vulnerability caused by insufficient access control in BI Publisher Security, letting low privileged network attackers access and modify critical data, exploit requires network access via HTTP.

  • 8.2 /10 High
    CVE-2026-83266 No auth

    Oracle JDeveloper - Broken Access Control

    Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain an unauthorized access and partial denial of service vulnerability caused by improper access control in Resource Catalog Services, letting unauthenticated network attackers access critical data and cause partial DoS, exploit requires network access via HTTP.

  • 8.2 /10 High
    CVE-2026-83265 No auth

    Oracle Web Services Manager - Broken Access Control

    Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 contain an unauthorized access vulnerability caused by improper access control in Web Services Agent, letting unauthenticated network attackers access and modify critical data via HTTP.

  • 8.4 /10 High
    CVE-2026-83264 Auth required

    Oracle Product Lifecycle Analytics - Broken Access Control

    Oracle Product Lifecycle Analytics 3.6.1 contains a broken access control vulnerability caused by installation issues, letting low privileged logged-in attackers modify or access critical data, exploit requires attacker logon to infrastructure.

  • 7.5 /10 High
    CVE-2026-83263 Auth required

    Oracle Product Lifecycle Analytics - Authentication Bypass

    Oracle Product Lifecycle Analytics 3.6.1 contains a vulnerability caused by installation issues, letting low privileged attackers with network access via HTTP take over the product, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-83262 Auth required

    Oracle Product Lifecycle Analytics - Authentication Bypass

    Oracle Product Lifecycle Analytics 3.6.1 contains a takeover vulnerability caused by installation issues, letting low privileged attackers with network access via HTTP compromise the product, exploit requires low privileges and network access.

  • 9.8 /10 Critical
    CVE-2026-83261 No auth

    Oracle Product Lifecycle Analytics - Remote Code Execution

    Oracle Product Lifecycle Analytics 3.6.1 contains a remote unauthenticated takeover vulnerability caused by an easily exploitable issue in the core component, letting attackers fully compromise the system, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83260 Auth required

    Oracle Agile PLM - Remote Code Execution

    Oracle Agile PLM 9.3.6 contains a remote code execution caused by vulnerability in Event Java PX component, letting high privileged attackers with network access via T3, IIOP fully compromise the system, exploit requires high privileges.

  • 7.1 /10 High
    CVE-2026-83259 Auth required

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access and partial denial of service vulnerability caused by insufficient access controls in Forge component, letting low privileged attackers with network access via HTTP compromise critical data and cause partial DoS, exploit requires low privileged network access.

  • 8.1 /10 High
    CVE-2026-83258 No auth

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires high attack complexity.

  • 7.5 /10 High
    CVE-2026-83257 Auth required

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass

    Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an unspecified issue in Forge component, letting low privileged attackers with network HTTP access compromise the system, exploit requires network access with low privileges.