Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 553 of 677

  • 9.8 /10 Critical
    CVE-2026-12351

    IBM MQ - Remote Code Execution

    IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 contain a remote code execution caused by unsafe JNDI lookup processing in IVT application deployment, letting remote attackers execute arbitrary code, exploit requires IVT application deployment.

  • 7.0 /10 High
    CVE-2026-12150

    IBM MQ - Denial of Service

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a denial of service caused by improper validation of deeply nested certificate data during TLS certificate processing, letting remote attackers with trusted TLS client certificates cause service disruption and potential memory corruption, exploit requires trusted TLS client certificate.

  • 8.1 /10 High
    CVE-2026-12101 No auth

    IBM Verify Identity Access - Broken Access Control

    IBM Verify Identity Access contains a broken access control vulnerability caused by improper validation of user-supplied requests, letting administrators execute unauthorized commands, exploit requires administrator privileges.

  • 7.2 /10 High
    CVE-2026-11934 Auth required

    IBM Verify Identity Access - Command Injection

    IBM Verify Identity Access contains a command injection caused by improper validation of user supplied input, letting administrators execute unauthorized commands, exploit requires administrator privileges.

  • 7.5 /10 High
    CVE-2026-11929

    IBM Security Verify Identity Access Reverse Proxy - Weak Cryptography

    IBM Security Verify Identity Access Reverse Proxy contains a weak cryptographic validation vulnerability caused by improper validation of user supplied data, letting attackers bypass cryptographic protections, exploit requires specific configuration.

  • 9.8 /10 Critical
    CVE-2026-11928 No auth

    IBM Verify Identity Access - Buffer Overflow

    IBM Verify Identity Access contains a buffer overflow vulnerability that allows attackers to cause memory corruption or remote code execution, exploit requires crafted input.

  • 7.5 /10 High
    CVE-2026-11926 No auth

    IBM Verify Identity Access - Denial of Service

    IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.

  • 9.1 /10 Critical
    CVE-2026-11921

    IBM Verify Identity Access - Broken Authentication

    IBM Verify Identity Access containers contain a misconfiguration causing management password change operations to be applied incorrectly, letting attackers potentially bypass password update mechanisms, exploit requires container management access.

  • 8.5 /10 High
    CVE-2026-11729 Auth required

    IBM MQ - Insecure Deserialization

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by unsafe deserialization enabling JNDI injection, letting authenticated attackers execute arbitrary code in client applications, exploit requires authentication.

  • 8.1 /10 High
    CVE-2026-11728 No auth

    IBM MQ - Buffer Overflow

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a heap buffer overflow caused by improper handling of messages from malicious queue managers or man-in-the-middle attacks, letting remote attackers cause denial of service or execute arbitrary code in the client, exploit requires network access to the client.

  • 7.8 /10 High
    CVE-2026-10144 No auth

    Rsbuild - Command Injection

    Rsbuild < 2.0.9 contains a command injection caused by improper sanitization of shell metacharacters in URLs passed to server.open configuration on macOS, letting attackers execute arbitrary OS commands remotely, exploit requires crafted URL with shell metacharacters.

  • 8.8 /10 High
    CVE-2026-0200 Auth required

    Cellular Modem - Privilege Escalation

    Cellular Modem contains an out-of-bounds write caused by a heap buffer overflow, letting remote attackers escalate privileges without additional execution privileges, exploit requires no user interaction.

  • 7.8 /10 High
    CVE-2026-0199 Auth required

    gf_ta_test - Buffer Overflow

    gf_ta_test.c contains a buffer overflow caused by improper input validation in gf_ta_test_set_config, letting local attackers escalate privileges without additional execution rights, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-0194 No auth

    Affected product - Privilege Escalation

    Affected product contains a privilege escalation caused by an integer overflow in multiple locations, letting local attackers bypass permissions without additional execution privileges, exploit requires no user interaction.

  • 8.4 /10 High
    CVE-2026-0189 No auth

    ac_init_policy - Permission Bypass

    ac_init_policy contains a permission bypass caused by a logic error in init.c, letting local attackers escalate privileges without additional execution privileges, exploit requires no user interaction.