Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 29 of 891
- 7.1 /10 HighCVE-2026-119407 No auth
Element Web & Desktop - Authentication Bypass
Element Web and Element Desktop < 1.12.32 contain an authentication bypass caused by accepting guest credentials from URL fragment parameters in loadSession, letting remote unauthenticated attackers log out users and clear local stores, exploit requires user to open crafted link.
- 7.8 /10 HighCVE-2026-119379 No auth
SQLite - Buffer Overflow
SQLite before 3.54.0 with session extension contains a heap buffer overflow caused by improper handling of crafted changesets in sqlite3changeset_apply(), letting attackers corrupt heap memory remotely, exploit requires crafted changesets.
- 7.8 /10 HighCVE-2026-119374
SQLite - Buffer Overflow
SQLite < 3.54.0 built with FTS5 contains a heap buffer overflow caused by crafted footer key offsets in fts5DoSecureDelete(), letting attackers corrupt heap memory and crash the application, exploit requires crafted database file with corrupted FTS5 index and secure-delete enabled.
- 7.8 /10 HighCVE-2026-119373
SQLite - Buffer Overflow
SQLite < 3.54.0 built with FTS5 contains a heap buffer overflow caused by undersized output buffer in fts5MergeRowidLists() when merging detail=none prefix doclists, letting attackers corrupt heap memory and crash the process, exploit requires ability to populate detail=none FTS5 table with negative rowids and run prefix MATCH query.
- 7.1 /10 HighCVE-2026-119337 Auth required
RAGFlow - Broken Access Control
RAGFlow 0.25.2 to < 0.27.3 contains a broken access control caused by missing authorization checks before UserCanvasService.accessible(), letting authenticated users access private agents of others and read outputs, exploit requires authentication and knowledge of another user's private agent UUID.
- 7.8 /10 HighCVE-2026-119336 Auth required
Pi-hole - Race Condition
Pi-hole 6.4.2 to < 6.5 contains a race condition and symlink vulnerability in the root-run updatecheck.sh cron job, letting attackers with pihole user privileges modify root-owned files or change permissions, exploit requires attacker to have pihole user access.
- 7.8 /10 HighCVE-2026-119335 Auth required
Pi-hole - Command Injection & Privilege Escalation
Pi-hole prior to 6.5 contains a command injection caused by improper validation of the pihole-owned PID file in advanced/Scripts/utils.sh getFTLPID(), letting attackers with pihole user code execution escalate to root via Bash evaluation, exploit requires code execution as pihole user.
- 7.8 /10 HighCVE-2026-119333 No auth
draw.io Desktop - Command Injection
draw.io Desktop < 31.5.2 contains a command injection caused by launching powershell and attrib by bare executable name in electron.js, letting attacker-controlled executables run when opening diagrams, exploit requires victim to open attacker-supplied files.
- 8.8 /10 HighCVE-2026-119332 No auth
Ladybird - Use After Free
Ladybird web browser contains a use-after-free vulnerability caused by improper iterator handling in FinalizationRegistry::cleanup(), letting attackers trigger memory corruption via crafted JavaScript callbacks, exploit requires attacker-controlled JavaScript execution.
- 7.1 /10 HighCVE-2026-119331 No auth
Ladybird - Broken Access Control
Ladybird web browser contains a broken access control vulnerability caused by missing enforcement of the stylesheet origin-clean flag in CSSStyleSheet methods, letting malicious pages read and modify cross-origin stylesheets, bypassing Same-Origin Policy.
- 7.5 /10 HighCVE-2026-119290 No auth
Zuke - Information Disclosure
Zuke < 1.51.0 contains an information disclosure vulnerability caused by lack of redaction in reportSummary notes written to GITHUB_STEP_SUMMARY, letting attackers view secret-derived credentials in workflow run summaries, exploit requires GitHub Actions usage with secret-derived text in summary.
- 7.1 /10 HighCVE-2026-119289
Zuke - Broken Access Control
Zuke prior to 1.10.0 contains a broken access control caused by insufficient verification of dispatched workflow runs in @zuke/gh githubWorkflow(...) gate, letting attackers substitute workflow runs to authorize or block releases, exploit requires external workflow repository granting workflow_dispatch permission to untrusted parties.
- 7.0 /10 HighCVE-2026-119288
Zuke - Command Injection
Zuke < 1.51.0 contains a command injection caused by improper quoting of Windows .cmd and .bat shim execution, letting attackers execute arbitrary commands in build context with credentials, exploit requires attacker-influenced input containing unquoted metacharacters.
- 8.0 /10 HighCVE-2026-119287 Auth required
Zuke - Command Injection
Zuke prior to 1.51.0 contains a command injection caused by accepting command-form registry descriptors without proper authorization enforcement, letting remote registry writers execute arbitrary commands with operator privileges, exploit requires use of MCP registry mode with --allow-run.
- 8.8 /10 HighCVE-2026-119271 No auth
Google Chrome - Use After Free
Google Chrome < 156.0.8078.79 contains a use after free vulnerability in Skia, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.