Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 704 of 767

  • 8.5 /10 High
    CVE-2026-81540 Auth required

    IBM DataStage - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of file paths, letting remote authenticated attackers overwrite ruleset files of other tenants.

  • 9.1 /10 Critical
    CVE-2026-81468 Auth required

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.

  • 9.8 /10 Critical
    CVE-2026-81467 No auth

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting unauthenticated remote attackers execute arbitrary commands, exploit requires remote access.

  • 7.2 /10 High
    CVE-2026-81431 Auth required

    WooCommerce WordPress plugin - Broken Access Control

    WooCommerce WordPress plugin < 1.1.3 contains a broken access control vulnerability caused by improper validation of registration forms, letting users with post creation privileges register accounts with arbitrary roles including Administrator, exploit requires user with Contributor or higher privileges.

  • 8.1 /10 High
    CVE-2026-81268 Auth required

    IBM Langflow OSS - Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an authentication bypass caused by insufficient session expiration of API keys after user deactivation, letting remote authenticated attackers execute flows and obtain sensitive information.

  • 7.5 /10 High
    CVE-2026-81265

    CVE-2026-81265

    IBM Langflow OSS 1.0.0 through 1.11.5.

  • 8.6 /10 High
    CVE-2026-81213 No auth

    IBM Langflow OSS - Information Disclosure

    IBM Langflow OSS 1.0.0 through 1.11.5 contains an information disclosure vulnerability caused by improper validation of user-supplied URLs, letting remote attackers obtain sensitive information from internal network resources, exploit requires crafted URL input.

  • 8.8 /10 High
    CVE-2026-81211 Auth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper authorization of custom components in stored flows, letting remote authenticated attackers execute arbitrary Python code.

  • 7.7 /10 High
    CVE-2026-81210

    IBM DataStage - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an insecure direct object reference and path traversal caused by concatenation of caller-supplied strings into a String.format path on shared /ds-storage RWX PVC, letting attackers read sensitive job log files, exploit requires access to the shared PVC.

  • 8.5 /10 High
    CVE-2026-81207 Auth required

    IBM DataStage - Server Side Request Forgery

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a server-side request forgery caused by allowing any authenticated tenant to control outbound fetch parameters, letting attackers reflect WSDL responses and access internal services, exploit requires authentication without project membership.

  • 9.8 /10 Critical
    CVE-2026-81204 No auth

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by code injection during graph construction, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.6 /10 Critical
    CVE-2026-81048 No auth

    Dell ThinOS - Command Injection

    Dell ThinOS < 2605_10.2616 contains a command injection caused by improper neutralization of special elements in command processing, letting unauthenticated adjacent network attackers execute remote code.

  • 9.4 /10 Critical
    CVE-2026-81046 No auth

    Dell ThinOS - Remote Code Execution

    Dell ThinOS < 2605_10.2616 contains a protection mechanism failure vulnerability allowing unauthenticated remote attackers to execute arbitrary code within the application context.

  • 8.5 /10 High
    CVE-2026-80436 Auth required

    IBM DataStage on Cloud Pak for Data - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a denial of service caused by improper authorization allowing remote authenticated attackers to delete arbitrary RabbitMQ queues or exchanges, exploit requires authentication.

  • 7.4 /10 High
    CVE-2026-80434 Auth required

    IBM DataStage on Cloud Pak for Data - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a broken access control caused by insecure direct object reference in runtime caches, letting remote authenticated attackers cause denial of service.