Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 376 of 767

  • 7.3 /10 High
    CVE-2026-103286 Auth required

    Ghost - Privilege Escalation

    Ghost >2.21.0 <6.56.0 contains a privilege escalation caused by improper authorization checks in the notifications system, letting low-privilege staff users escalate to higher-privilege staff roles, exploit requires low-privilege staff access.

  • 8.1 /10 High
    CVE-2026-103283 Auth required

    Ghost - Authentication Bypass

    Ghost 6.20.0 < 6.57.1 contains a broken authentication caused by improper session handling, letting authenticated staff users bypass two-factor authentication and impersonate other staff users, exploit requires valid staff credentials.

  • 7.3 /10 High
    CVE-2026-103278 Auth required

    Ghost - Authentication Bypass

    Ghost 5.8.0 < 6.34.0 contains an input validation vulnerability in the admin iframe, letting attackers with content publishing privileges take over staff user accounts, exploit requires crafted malicious pages visited by active staff users.

  • 8.1 /10 High
    CVE-2026-103277 No auth

    Ghost - Stored XSS

    Ghost > 2.5.0 < 6.34.0 contains a stored XSS caused by unsandboxed externally hosted scripts in the oEmbed preview feature, letting attackers execute scripts in staff admin sessions, exploit requires crafted malicious oEmbed content.

  • 7.5 /10 High
    CVE-2026-103272 No auth

    Ghost - Broken Access Control

    Ghost 2.10.0 < 6.63.0 contains a staff enumeration vulnerability caused by discrepancies in content API metadata responses, letting unauthenticated attackers leak user data, exploit requires no authentication.

  • 7.5 /10 High
    CVE-2026-103271 No auth

    Ghost - Broken Access Control

    Ghost 4.0.0 < 6.63.0 contains an information disclosure vulnerability caused by improper access control in the content API, letting unauthenticated visitors access gated post content, exploit requires no authentication.

  • 8.8 /10 High
    CVE-2026-103268 Auth required

    Ghost - Authentication Bypass

    Ghost < 6.62.0 contains an authentication bypass caused by allowing suspended staff users to reactivate accounts via self-service password reset, letting suspended staff attackers regain active access and privileges, exploit requires suspended staff credentials.

  • 7.1 /10 High
    CVE-2026-103266 No auth

    Ghost - Cross-Site Scripting

    Ghost 5.2.0 through < 6.62.0 contains a cross-site scripting caused by abuse of Stripe Checkout flow allowing modification of member data and newsletter content, letting remote attackers inject HTML or scripts, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-103264 No auth

    Fleet - Authentication Bypass

    Fleet < 4.87.0 contains an authentication bypass caused by acceptance of hostnames and hardware serials as authentication tokens in device API, letting unauthenticated attackers access device data and trigger device actions, exploit requires knowledge of non-secret identifiers.

  • 7.5 /10 High
    CVE-2026-103262 No auth

    Tornado - Denial of Service

    Tornado < 6.5.9 contains a denial of service vulnerability caused by unbounded memory accumulation in CurlAsyncHTTPClient when processing compressed responses, letting remote attackers cause application crash via decompression bomb, exploit requires sending crafted compressed response.

  • 7.6 /10 High
    CVE-2026-103259

    n8n - Authentication Bypass

    n8n < 2.39.6 and 2.40.0 < 2.40.1 contain a session token leakage caused by fallback resolver manipulation in Dynamic Credentials authorize and revoke endpoints, letting attackers with resolver registration capture collaborators' session tokens, exploit requires resolver registration capability.

  • 7.7 /10 High
    CVE-2026-103257 No auth

    n8n - Path Traversal

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a path traversal caused by improper validation of resource identifiers in the n8n node, letting attackers access unauthorized workflows, executions, and credential secrets, exploit requires crafted resource IDs.

  • 7.1 /10 High
    CVE-2026-103256 Auth required

    n8n - Information Disclosure

    n8n < 2.39.6 and 2.40.0 < 2.40.1 contain a credentials leak caused by sending unencrypted passwords to unvalidated hosts in Wekan and Baserow username-and-password credentials, letting attackers with credential update permissions leak passwords, exploit requires credential update permissions.

  • 9.0 /10 Critical
    CVE-2026-103255 No auth

    n8n - Path Traversal

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a path traversal caused by unvalidated insertion of tableId parameter in Supabase node request paths, letting attackers bypass Row Level Security to access and modify data, exploit requires workflows binding tableId to untrusted input.

  • 8.7 /10 High
    CVE-2026-103253 No auth

    n8n - SQL Injection

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain an SQL injection caused by improper sanitization in Oracle Database node's Delete Table Drop operation, letting attackers execute arbitrary SQL commands with database privileges, exploit requires access to the node.