Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 613 of 677

  • 7.5 /10 High
    CVE-2026-81786 No auth

    Thank You Page Customizer for WooCommerce - Broken Access Control

    Thank You Page Customizer for WooCommerce <= 1.2.2 contains an unauthenticated broken access control vulnerability, letting unauthenticated attackers access or modify restricted resources.

  • 8.1 /10 High
    CVE-2026-81784 No auth

    Wise Chat - Insecure Deserialization

    Wise Chat <= 3.4 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 7.1 /10 High
    CVE-2026-81783 Auth required

    MailMunch - Authentication Bypass

    MailMunch <= 3.2.5 contains a broken authentication vulnerability in Subscriber component, letting attackers bypass authentication mechanisms, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-81554 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers obtain sensitive information.

  • 8.8 /10 High
    CVE-2026-81551 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper validation of file paths, letting remote authenticated attackers write or delete files on shared storage.

  • 8.8 /10 High
    CVE-2026-81550 Auth required

    IBM DataStage on Cloud Pak for Data - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary code.

  • 8.5 /10 High
    CVE-2026-81540 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of file paths, letting remote authenticated attackers overwrite ruleset files of other tenants.

  • 9.1 /10 Critical
    CVE-2026-81468 Auth required

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.

  • 9.8 /10 Critical
    CVE-2026-81467 No auth

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting unauthenticated remote attackers execute arbitrary commands, exploit requires remote access.

  • 7.2 /10 High
    CVE-2026-81431 Auth required

    WooCommerce WordPress plugin - Broken Access Control

    WooCommerce WordPress plugin < 1.1.3 contains a broken access control vulnerability caused by improper validation of registration forms, letting users with post creation privileges register accounts with arbitrary roles including Administrator, exploit requires user with Contributor or higher privileges.

  • 8.1 /10 High
    CVE-2026-81268 Auth required

    IBM Langflow OSS - Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an authentication bypass caused by insufficient session expiration of API keys after user deactivation, letting remote authenticated attackers execute flows and obtain sensitive information.

  • 7.5 /10 High
    CVE-2026-81265

    CVE-2026-81265

    IBM Langflow OSS 1.0.0 through 1.11.5.

  • 8.6 /10 High
    CVE-2026-81213 No auth

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an information disclosure vulnerability caused by improper validation of user-supplied URLs, letting remote attackers obtain sensitive information from internal network resources, exploit requires crafted URL input.

  • 8.8 /10 High
    CVE-2026-81211 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper authorization of custom components in stored flows, letting remote authenticated attackers execute arbitrary Python code.

  • 7.7 /10 High
    CVE-2026-81210

    IBM DataStage - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an insecure direct object reference and path traversal caused by concatenation of caller-supplied strings into a String.format path on shared /ds-storage RWX PVC, letting attackers read sensitive job log files, exploit requires access to the shared PVC.