Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 572 of 677
- 8.8 /10 HighCVE-2026-16673 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special characters in the PxPeek name property, letting remote authenticated attackers execute arbitrary OS commands.
- 8.8 /10 HighCVE-2026-16466 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper handling of OS commands, letting remote authenticated attackers execute arbitrary commands.
- 7.7 /10 HighCVE-2026-16432 Auth required
IBM DataStage - XML External Entity Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML external entity injection caused by improper handling in PxXMLInput operator, letting remote authenticated attackers obtain sensitive information.
- 8.8 /10 HighCVE-2026-16428 Auth required
IBM DataStage - Remote Code Execution
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a remote code execution caused by improper configuration of the XSLT transformation engine, letting remote authenticated attackers execute arbitrary code.
- 9.9 /10 CriticalCVE-2026-16338 Auth required
IBM DataStage - Unrestricted File Upload
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an unrestricted file write vulnerability caused by improper validation of file paths, letting remote authenticated attackers write arbitrary files.
- 8.1 /10 HighCVE-2026-16335 Auth required
IBM DataStage - Path Traversal
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers read, write, or delete arbitrary files, exploit requires authentication.
- 7.5 /10 HighCVE-2026-15955 No auth
IBM Db2 - Unrestricted File Upload
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain an unrestricted file write vulnerability caused by improper validation of file paths, letting remote attackers write arbitrary files, exploit requires network access.
- 8.8 /10 HighCVE-2026-13293 Auth required
IBM MQ - Insecure Deserialization
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote authenticated attackers execute arbitrary code on the system, exploit requires authentication.
- 7.1 /10 HighCVE-2026-13287 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an XML external entity injection caused by unsafe XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML data.
- 7.1 /10 HighCVE-2026-13285 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contains an XML external entity injection caused by improper processing of XML data, letting remote attackers expose sensitive information or consume memory resources, exploit requires sending crafted XML data.
- 7.1 /10 HighCVE-2026-13275 Auth required
IBM MQ - XML External Entity Injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer contain an XML external entity injection caused by improper reply message processing, letting authenticated attackers read arbitrary files or perform server-side request forgery, exploit requires authentication.
- 7.5 /10 HighCVE-2026-13260 No auth
IBM Verify Identity Access - Denial of Service
IBM Verify Identity Access contains a denial of service vulnerability caused by insufficient validation of incoming request resources, letting remote attackers cause service disruption, exploit requires crafted requests.
- 7.1 /10 HighCVE-2026-13107 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML External Entity Injection vulnerability caused by default use of programming model artifacts, letting attackers perform XML entity injection, exploit requires crafted XML input.
- 9.6 /10 CriticalCVE-2026-12944 PoC publicAuth required
IBM Langflow OSS - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by submission of components with socket or urllib imports, letting attackers execute arbitrary Python code with root privileges, exploit requires crafted component submission.
- 7.1 /10 HighCVE-2026-12756 Auth required
IBM Business Automation Workflow - XML External Entity Injection
IBM Business Automation Workflow contains an XML external entity injection caused by improper XML data processing, letting remote attackers expose sensitive information or consume memory resources, exploit requires crafted XML input.