Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 377 of 767

  • 7.7 /10 High
    CVE-2026-103252 Auth required

    n8n - Authorization Bypass

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain an authorization bypass caused by lack of caller access validation in the credential test endpoint, letting attackers exfiltrate sensitive variables by specifying arbitrary project IDs, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-103251

    n8n - Authentication Bypass & Remote Code Execution

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a validation bypass caused by improper checks in the community package installation handler for queue mode deployments, letting attackers with Redis write access install arbitrary npm packages without authentication.

  • 8.1 /10 High
    CVE-2026-103250 No auth

    n8n - NoSQL Injection

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a NoSQL injection caused by improper validation of the sessionId parameter in the MongoDB Chat Memory node, letting unauthenticated attackers access and modify other users' conversation histories, exploit requires no authentication.

  • 7.6 /10 High
    CVE-2026-103249 Auth required

    n8n - Stored XSS

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a stored XSS caused by improper sanitization of Resource Locator parameter dropdown link, letting workflow authors execute arbitrary JavaScript in editor origin when other users interact with the node dropdown, exploit requires other users to open the node dropdown and click the external-link icon.

  • 9.0 /10 Critical
    CVE-2026-103248 No auth

    n8n - NoSQL Injection

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a filter injection vulnerability in Supabase node's Filters (String) mode caused by failure to escape field values, letting attackers read, update, or delete all table data remotely, exploit requires crafted input.

  • 8.5 /10 High
    CVE-2026-103247 Auth required

    n8n - Broken Access Control

    n8n < 1.123.80 contains a credential tampering vulnerability caused by duplicate node IDs bypassing workflow credential tamper guard, letting attackers with editor access retain victim credentials and redirect secrets.

  • 7.7 /10 High
    CVE-2026-103246 Auth required

    n8n - Broken Access Control

    n8n < 2.39.6 and 2.40.0 < 2.40.1 contain an information disclosure vulnerability caused by failure to validate credential ownership during inline agent node-tool introspection, letting attackers decrypt and exfiltrate plaintext secrets without ownership verification.

  • 9.8 /10 Critical
    CVE-2026-103244 No auth

    ground-station - Authentication Bypass

    ground-station < 0.8.0 contains an authentication bypass caused by improper validation in setup.restore command during first-run setup mode, letting unauthenticated attackers execute arbitrary SQL and gain admin access, exploit requires first-run setup mode.

  • 7.2 /10 High
    CVE-2026-103082 No auth

    LA-Studio LA-Studio Element Kit for Elementor - Server Side Request Forgery

    LA-Studio LA-Studio Element Kit for Elementor <= 1.6.2 contains a server side request forgery caused by improper validation of URLs, letting attackers make arbitrary requests from the server, exploit requires crafted request.

  • 8.8 /10 High
    CVE-2026-103068 Auth required

    ByteCoreStack MCP Connector for AI Tools - Privilege Escalation

    ByteCoreStack MCP Connector for AI Tools <= 1.2.2 contains a privilege escalation vulnerability caused by improper subscriber privilege management, letting attackers escalate their privileges, exploit requires subscriber access.

  • 8.0 /10 High
    CVE-2026-103067 Auth required

    Memberful Memberful - Membership Plugin - Cross Site Request Forgery

    Memberful Memberful - Membership Plugin <= 1.81.0 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 8.3 /10 High
    CVE-2026-102667 No auth

    Joyland AI - Stored XSS

    Joyland AI app contains a stored XSS caused by JavaScript injection in WebView content, letting attackers with shared network access execute scripts and access sensitive resources, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-102628 No auth

    Cadmos LTI - Information Disclosure

    Cadmos LTI application contains an information disclosure vulnerability caused by enabled Laravel debug mode in a public environment, letting unauthenticated attackers access sensitive server environment variables via unhandled exceptions, exploit requires no authentication.

  • 8.4 /10 High
    CVE-2026-102514 No auth

    PeaZip - Remote Code Execution

    PeaZip <= 11.2.0 contains an out-of-bounds write caused by improper validation of the first block compressed size in the PEA archive extraction routine, letting attackers execute arbitrary code by opening crafted .pea archives, exploit requires victim to open or extract the archive.

  • 7.5 /10 High
    CVE-2026-102504 No auth

    Perl Imager - Denial of Service

    Perl Imager < 1.037 contains a denial of service caused by lack of range checking on raw_datachannels in i_readraw_wiol, letting attackers trigger uncatchable process exit by passing crafted raw_datachannels value, exploit requires attacker to provide untrusted input.