Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 28 of 891
- 7.3 /10 HighCVE-2026-119619 No auth
cak-filemanagement-system - SQL Injection
cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297 contains an SQL injection caused by manipulation of arguments date, department, subject, forwarded_to, action_taken_by, section, and password in admin/save_student.php mysqli_query, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-119597 No auth
OpenDeepWiki - Authentication Bypass
OpenDeepWiki through 2.0.6 contains a hardcoded credentials vulnerability caused by a publicly known JWT signing key in appsettings.json, letting unauthenticated attackers forge admin tokens to access sensitive admin endpoints, exploit requires no authentication.
- 7.8 /10 HighCVE-2026-119586 No auth
SQLite - Command Injection
SQLite command-line shell through 3.54.1 contains a command injection caused by attacker-planted dot-commands in sqlite_schema.sql values in the .recover command, letting attackers execute OS commands when .recover output is piped into sqlite3, exploit requires victim to pipe .recover output.
- 7.8 /10 HighCVE-2026-119578 No auth
MONAI - Remote Code Execution
MONAI 1.6.0 before 1.6.1 contains a remote code execution caused by unsafe deserialization in Auto3DSeg algo_from_json(), letting attackers execute arbitrary Python code via crafted algo_object.json, exploit requires victim to call AutoRunner or import_bundle_algo_history.
- 8.7 /10 HighCVE-2026-119572 No auth
Traefik - Authentication Bypass
Traefik 3.7.0-ea.1 before 3.7.15 contains an authentication bypass caused by silent disabling of mTLS via auth-tls-secret annotation in Kubernetes Ingress NGINX provider, letting unauthenticated attackers access backends requiring client certificates.
- 7.4 /10 HighCVE-2026-119568
vsftpd - Authentication Bypass
vsftpd through 3.0.5 contains an authentication bypass caused by TLS session ticket resumption in ssl_data_accept(), letting unauthenticated attackers sharing victim's source IP hijack FTPS data connections, exploit requires attacker to share victim's source IP.
- 7.1 /10 HighCVE-2026-119549 Auth required
Jellyfin - Server Side Request Forgery
Jellyfin <= 12.4 contains a server-side request forgery caused by bypassing SvgSecurityValidator via gzip-compressed SVG in non-SVG image data URIs, letting authenticated users fetch internal URLs or exhaust memory, exploit requires user authentication.
- 7.8 /10 HighCVE-2026-119528 No auth
GIMP - Buffer Overflow
GIMP contains a stack-based buffer overflow caused by incorrect destination size usage in the PSD plug-in's image resource header loader, letting attackers execute arbitrary code by opening crafted PSD files, exploit requires opening crafted PSD files.
- 9.8 /10 CriticalCVE-2026-119526 No auth
ThemeREX Royal Event - Insecure Deserialization
ThemeREX Royal Event <= 2.0 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-119426 No auth
phpMyAdmin - Cross-Site Request Forgery
phpMyAdmin <= 5.2.3 contains a cross-site request forgery vulnerability caused by bypassing CSRF token checks on non-AJAX POST requests, letting remote attackers execute arbitrary SQL with victim's database privileges via crafted cross-site POSTs.
- 8.8 /10 HighCVE-2026-119420 Auth required
Lago - Authentication Bypass
Lago <= 1.55.0 contains an authentication bypass caused by missing password check in acceptInvite mutation, letting organization administrators obtain session tokens and access sensitive data, exploit requires attacker to invite victim's email.
- 8.1 /10 HighCVE-2026-119419 No auth
CakePHP - SQL Injection
CakePHP <= 5.4.3 contains an SQL injection caused by unvalidated collation values in StringExpression and IdentifierExpression, letting attackers inject SQL via COLLATE clause, exploit requires attacker control of collation input.
- 8.1 /10 HighCVE-2026-119418 No auth
CakePHP - SQL Injection
CakePHP <= 5.4.3 contains an SQL injection caused by unvalidated frame offsets and directions in WindowExpression::range() and frame(), letting attackers execute SQL with database privileges, exploit requires crafted user input forwarded to OVER clause.
- 7.2 /10 HighCVE-2026-119409 Auth required
OPNsense - Command Injection
OPNsense < 26.7.8 contains a command injection caused by improper evaluation of a malicious firmware mirror URL in opnsense-update, letting authenticated users with System: Firmware privilege execute commands as root, exploit requires System: Firmware privilege.
- 8.8 /10 HighCVE-2026-119408 Auth required
n8n - Remote Code Execution
n8n < 2.42.6, 2.43.x < 2.43.3, and 3.x < 3.0.1 contain a remote code execution caused by deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation, letting authenticated users execute JavaScript in the main process, exploit requires workflow creation or modification privileges.