Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 552 of 677

  • 7.1 /10 High
    CVE-2026-18423 Auth required

    Concrete CMS - Broken Access Control

    Concrete CMS 9.0.0 through 9.5.2 contains an insecure direct object reference (IDOR) caused by improper access control in Express saved search preset delete and edit dialogs, letting authenticated users with view permission delete or rename presets without proper authorization.

  • 7.5 /10 High
    CVE-2026-18110 PoC publicNo auth

    Concrete CMS - Broken Access Control

    Concrete CMS 9 (9.0.0 through 9.5.2) contains an information disclosure vulnerability caused by missing authorization checks on the user selector autocomplete endpoint, letting unauthenticated attackers enumerate backend user accounts, exploit requires no authentication.

  • 8.3 /10 High
    CVE-2026-1758 No auth

    Secomea GateManager - Authentication Bypass

    Secomea GateManager 11.4.625515072 and 11.5 contain a session fixation vulnerability caused by improper session management in the webserver module, letting attackers fixate user sessions, exploit requires victim to authenticate.

  • 8.1 /10 High
    CVE-2026-16141 No auth

    OpenBMC phosphor-net-ipmid - Authentication Bypass

    OpenBMC phosphor-net-ipmid contains a broken authentication caused by a logic flaw in RAKP Message 1 handler, letting unauthenticated clients bypass authentication using predictable keys, exploit requires unauthenticated network access.

  • 8.8 /10 High
    CVE-2026-16140 Auth required

    OpenBMC phosphor-net-ipmid - Privilege Escalation

    OpenBMC phosphor-net-ipmid contains a privilege escalation vulnerability caused by a logic flaw allowing session authorization context replacement without re-authentication, letting attackers escalate privileges.

  • 8.8 /10 High
    CVE-2026-14805 Auth required

    Consulting WordPress Theme - Privilege Escalation

    Consulting WordPress theme <= 6.7.16 contains a privilege escalation caused by improper capability checks and insecure transient authentication in admin AJAX endpoints, letting authenticated subscribers escalate to administrator via crafted URL.

  • 8.3 /10 High
    CVE-2026-13327

    Devolutions Server - Man in the Middle

    Devolutions Server <= 2026.2.16 contains an information disclosure vulnerability caused by improper certificate validation on LDAPS connections, letting network-positioned attackers intercept privileged directory service credentials via spoofed certificates, exploit requires network positioning.

  • 7.7 /10 High
    CVE-2026-13210 Auth required

    GitLab CE/EE - Broken Access Control

    GitLab CE/EE >= 15.7 and < 19.1.8, 19.2 and < 19.2.6, 19.3 and < 19.3.2 contain an information disclosure caused by improper input validation in the environment scope pattern matcher, letting authenticated users access CI/CD variables outside their intended environment scope, exploit requires user authentication.

  • 7.1 /10 High
    CVE-2026-12752 Auth required

    IBM Business Automation Workflow - XML External Entity Injection

    IBM Business Automation Workflow contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML input.

  • 8.8 /10 High
    CVE-2026-12728 Auth required

    IBM MQ - Remote Code Execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

  • 7.1 /10 High
    CVE-2026-12667 Auth required

    IBM MQ - XML External Entity Injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an XML external entity injection caused by improper handling of XML external entities in RFH2 folder parsing, letting authenticated attackers read files or cause limited denial of service.

  • 8.1 /10 High
    CVE-2026-12666 Auth required

    IBM MQ - XML External Entity Injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java contain an XML external entity injection caused by improper MQRFH2 header processing, letting authenticated attackers obtain sensitive information or cause denial of service, exploit requires authentication.

  • 7.5 /10 High
    CVE-2026-12358 No auth

    IBM Verify Identity Access - Denial of Service

    IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.

  • 8.1 /10 High
    CVE-2026-12355 No auth

    IBM MQ - JNDI Injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a JNDI injection caused by insufficient input validation, letting attackers perform remote code execution or information disclosure, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-12354 Auth required

    IBM MQ - Remote Code Execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a remote code execution caused by improper validation of JNDI names in the Resource Adapter Installation Verification Test application, letting authenticated attackers execute arbitrary code on the application server, exploit requires authentication.