Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 28 of 677

  • 7.2 /10 High
    CVE-2026-110844 Auth required

    n8n - Authorization Bypass

    n8n < 1.123.83 contains an authorization bypass caused by shared-workflow editors embedding restricted credentials in nested or inline sub-workflows, letting attackers execute workflows with unauthorized credential values, exploit requires shared-workflow editor privileges.

  • 8.2 /10 High
    CVE-2026-110843 No auth

    n8n - Denial of Service

    n8n < 2.41.4 and 2.42.x < 2.42.1 contains an uncontrolled resource consumption vulnerability caused by storing caller's raw identifier as record key in the unauthenticated OAuth authorize endpoint, letting unauthenticated attackers exhaust disk space by creating unlimited client records, exploit requires no authentication.

  • 7.7 /10 High
    CVE-2026-110842 Auth required

    n8n - Privilege Escalation

    n8n < 2.41.4 and 2.42.x < 2.42.1 contains a prototype pollution vulnerability caused by unsafe evaluation of caller-supplied code in MCP workflow-validation tool, letting authenticated users with workflow:read grant bypass permission checks and takeover owner accounts without MFA.

  • 7.0 /10 High
    CVE-2026-110840 No auth

    n8n - SQL Injection

    n8n < 2.41.4 and 2.42.x < 2.42.1 contains an SQL injection caused by direct substitution of Query field expression values in Microsoft SQL node, letting unauthenticated external callers execute arbitrary SQL with stored credential privileges, exploit requires untrusted input binding.

  • 7.1 /10 High
    CVE-2026-110839 No auth

    FreeRDP - Denial of Service

    FreeRDP < 3.32.0 built with WINPR_UTILS_IMAGE_JPEG=ON contains a heap-based out-of-bounds write caused by incorrect buffer sizing in winpr_convert_from_jpeg, letting malicious RDP servers crash clients via clipboard redirection with grayscale JPEGs.

  • 7.5 /10 High
    CVE-2026-110838 No auth

    FreeRDP - Authentication Bypass

    FreeRDP shadow server from 3.0.0 before 3.32.0 contains an input injection vulnerability caused by dispatching input PDUs during Confirm Active state before authentication, letting unauthenticated attackers inject keyboard input via XTEST.

  • 7.1 /10 High
    CVE-2026-110837 Auth required

    FreeRDP - Denial of Service

    FreeRDP < 3.32.0 with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF contains a heap-based buffer overflow caused by incorrect right-channel PCM pointer offset in freerdp_dsp_decode_mp3, letting malicious RDP servers crash the client, exploit requires malicious server sending crafted MP3 audio.

  • 8.1 /10 High
    CVE-2026-110770 No auth

    Databasus - Authentication Bypass

    Databasus 3.7.0 through 3.61.0 contains an authentication bypass caused by lack of rate limiting and invalidation on password reset codes in /api/v1/users/reset-password, letting unauthenticated attackers brute-force reset codes to take over accounts.

  • 8.6 /10 High
    CVE-2026-110769 No auth

    holaOS - Broken Access Control

    holaOS through 2026.822.1 contains a broken access control vulnerability in channel-gateway connectors caused by an empty default allowFrom list bypassing #isAllowed check, letting any messaging-platform user submit agent tasks and execute configured tools on the operator's machine, exploit requires attacker to message the operator's bot.

  • 7.5 /10 High
    CVE-2026-110767 No auth

    Gitingest - Path Traversal

    Gitingest <= 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion, letting unauthenticated attackers read server files by submitting symlink blob URLs.

  • 8.8 /10 High
    CVE-2026-110761 Auth required

    ILIAS - Remote Code Execution

    ILIAS < 9.24, 10.12, and 11.5 contains a PHP object injection caused by deserialization of crafted Test archives with malicious tst_sequence attribute, letting authenticated users with Test creation or import permission execute arbitrary code.

  • 7.2 /10 High
    CVE-2026-110719 No auth

    Portkey AI Gateway - Server Side Request Forgery

    Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery caused by isValidCustomHost trusting localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset, letting unauthenticated attackers access internal loopback and Docker host services via crafted x-portkey-custom-host headers.

  • 7.5 /10 High
    CVE-2026-110690 No auth

    Cloud Commander - Path Traversal

    Cloud Commander (cloudcmd) 19.20.2 through 19.21.1 contains a path traversal vulnerability caused by unguarded root() function usage in GET /api/v1/pack endpoint, letting attackers read arbitrary files outside the root directory.

  • 7.3 /10 High
    CVE-2026-110679 No auth

    OpenSIPS - Out of Bounds Read

    OpenSIPS <= 3.6.8/4.0.1 contains an out-of-bounds read caused by improper handling in rtpproxy_offer/rtpproxy_answer functions in rtpproxy component, letting remote attackers read memory out-of-bounds, exploit requires no special privileges.

  • 7.3 /10 High
    CVE-2026-110670 No auth

    cemtan sar2html - SQL Injection

    cemtan sar2html 4.0.0 contains a sql injection caused by manipulation of the argument s2host in the updateDb function of Archive Processing, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.