Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 27 of 677

  • 7.1 /10 High
    CVE-2026-110865 Auth required

    Renovate - Allowlist Bypass

    Renovate < 44.60.1 contains an allowlist bypass vulnerability caused by unvalidated hostRules headers in shared presets, letting repository users inject custom HTTP headers, exploit requires repository access.

  • 7.4 /10 High
    CVE-2026-110864 No auth

    Better Auth - Authentication Bypass

    Better Auth 1.5.0-beta.12 before 1.7.7 contains an authentication bypass caused by forging encrypted profiles in the OAuth Proxy plugin, letting unauthenticated attackers sign in as other users, exploit requires shared global secret and cookie-stored state.

  • 8.1 /10 High
    CVE-2026-110863 Auth required

    Better Auth - Authentication Bypass

    Better Auth @better-auth/sso >= 1.7.0-rc.2 < 1.7.3 contains an authentication bypass caused by ignoring providerId in account lookup when registering personal SSO providers, letting authenticated users sign in as other users.

  • 9.1 /10 Critical
    CVE-2026-110862 No auth

    Better Auth - Authentication Bypass

    Better Auth > 1.4.0-beta.18 < 1.7.7 contains an authentication bypass caused by reuse of OAuth state values as Magic Link tokens, letting unauthenticated attackers sign in as other users, exploit requires crafted OAuth sign-in.

  • 7.5 /10 High
    CVE-2026-110859 No auth

    GitPython - Command Injection

    GitPython < 3.2.0 contains an argument injection vulnerability in Head.checkout() caused by parsing branch names as git options, letting remote attackers read arbitrary files, exploit requires cloning a repository with a crafted default branch.

  • 8.1 /10 High
    CVE-2026-110858 No auth

    GitPython - Remote Code Execution

    GitPython > 3.1.30 < 3.2.0 contains a remote code execution caused by unsafe handling of positional refspec in Remote.pull(), letting attackers execute OS commands via --upload-pack, exploit requires attacker control of refspec.

  • 7.5 /10 High
    CVE-2026-110857 No auth

    GitPython - Remote Code Execution

    GitPython < 3.2.0 contains a remote code execution caused by unvalidated forwarding of URLs in Git.ls_remote and unguarded option injection in merge_base and IndexFile.move, letting attackers execute arbitrary commands remotely, exploit requires git ext transport enabled.

  • 7.5 /10 High
    CVE-2026-110856 No auth

    GitPython - Denial of Service

    GitPython < 3.2.0 contains a regular expression denial of service caused by the _re_actor_epoch pattern in parse_actor_and_date on author, committer, and tagger lines, letting attackers cause CPU exhaustion via crafted repository data, exploit requires attacker to serve malicious repository data.

  • 8.2 /10 High
    CVE-2026-110854 No auth

    Parse Server - Denial of Service

    Parse Server < 8.6.97 and 9.0.0 < 9.10.2-alpha.6 contains a denial of service caused by unhandled errors during email verification or password reset sending, letting clients with public application keys crash the server, exploit requires client access with public keys.

  • 7.1 /10 High
    CVE-2026-110853 Auth required

    n8n - Authorization Bypass

    n8n < 1.123.83 contains an authorization bypass caused by trusted identifier spoofing in Execute Sub-workflow inline JSON mode, letting authenticated members access and modify workflows they do not belong to, exploit requires authentication.

  • 7.2 /10 High
    CVE-2026-110850 Auth required

    n8n - Broken Access Control

    n8n < 2.41.4 and 2.42.0 < 2.42.1 contain an information disclosure caused by improper validation of credential IDs in agent node parameters, letting editors access and exfiltrate owner's decrypted secrets, exploit requires editor privileges.

  • 7.2 /10 High
    CVE-2026-110849 Auth required

    n8n - Stored XSS

    n8n < 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting caused by re-publishing binary data as an unsandboxed same-origin blob URL in the file-preview modal, letting authenticated members execute scripts in the session of previewers, exploit requires attacker to upload crafted item.

  • 7.0 /10 High
    CVE-2026-110847 Auth required

    n8n - Stored XSS

    n8n < 1.123.83, 2.x < 2.41.4, and 2.42.x < 2.42.1 contain a stored cross-site scripting caused by insufficient sanitization of customCss values in the Chat Trigger hosted-chat page, letting workflow authors publish malicious chat payloads executing on signed-in visitors' sessions, exploit requires published chat without user authentication.

  • 7.0 /10 High
    CVE-2026-110846 No auth

    n8n - Authentication Bypass

    n8n < 2.41.4 and 2.42.x < 2.42.1 contains a signature bypass caused by improper validation in the waiting-webhook endpoint, letting attackers with execution resume tokens approve others' executions and run actions as workflow owners.

  • 7.7 /10 High
    CVE-2026-110845 Auth required

    n8n - Remote Code Execution

    n8n < 1.123.83, 2.x < 2.41.4, and 2.42.x < 2.42.1 contain a remote code execution caused by failure to strip local git configuration in the Git node Log operation, letting authenticated users execute programs as the n8n process user, exploit requires authenticated access.