Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10203
- Critical
- 1875
- CISA KEV
- 79
- Public PoC
- 367
Most common types
- Broken Access Control 1267
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 525 of 681
- 8.1 /10 HighCVE-2026-83256 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access compromise the system, exploit requires high attack complexity.
- 8.1 /10 HighCVE-2026-83255 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access compromise the system, exploit requires high attack complexity.
- 8.1 /10 HighCVE-2026-83254 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified flaw in Forge component, letting unauthenticated attackers with network access compromise the system, exploit requires high attack complexity.
- 7.8 /10 HighCVE-2026-83253 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an easily exploitable issue in Endeca Application Controller, letting unauthenticated attackers with infrastructure access fully compromise the product, exploit requires human interaction from a user other than the attacker.
- 7.0 /10 HighCVE-2026-83252 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access vulnerability in Forge component, letting unauthenticated attackers with network access via HTTP gain unauthorized data access, modify data, and cause partial denial of service.
- 7.8 /10 HighCVE-2026-83249 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an unspecified issue in Forge component, letting low privileged attackers with logon compromise the system, exploit requires local access with logon.
- 8.2 /10 HighCVE-2026-83248 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Denial of Service & Information Disclosure
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a denial of service and information disclosure caused by unauthenticated network access via HTTP, letting attackers cause application crashes and read accessible data.
- 7.8 /10 HighCVE-2026-83247 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an easily exploitable flaw in the Forge component, letting unauthenticated attackers compromise the system, exploit requires human interaction from a user other than the attacker.
- 8.1 /10 HighCVE-2026-83246 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified flaw in Forge component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires high attack complexity.
- 8.1 /10 HighCVE-2026-83245 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Remote Code Execution
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a remote takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires high attack complexity.
- 7.1 /10 HighCVE-2026-83244
Oracle Commerce - Undefined
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an undefined vulnerability in Forge component, letting unauthenticated attackers with physical network access cause unauthorized data access, modification, or denial of service.
- 7.7 /10 HighCVE-2026-83243 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an information disclosure vulnerability caused by improper access control, letting low privileged attackers with network access via HTTP gain unauthorized access to critical data, exploit requires low privileged network access.
- 7.3 /10 HighCVE-2026-83242 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an unauthorized access vulnerability caused by improper access control, letting unauthenticated attackers update, insert, delete, read data, and cause partial denial of service via HTTP network access.
- 7.5 /10 HighCVE-2026-83241 No auth
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Authentication Bypass
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a takeover vulnerability caused by an unspecified issue in Forge component, letting unauthenticated attackers with network access via HTTP and user interaction compromise the system.
- 7.1 /10 HighCVE-2026-83240 Auth required
Oracle Commerce Guided Search / Oracle Commerce Experience Manager - Broken Access Control
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a broken access control vulnerability caused by insufficient privilege checks in Forge component, letting low privileged logged-in attackers modify critical data or cause denial of service.