Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 42 of 891

  • 7.3 /10 High
    CVE-2026-119282 No auth

    Nx - Command Injection

    Nx versions 22.0.2 to 22.7.9 and 23.1.2 for @nx/maven, and 21.0.0 to 22.7.9 and 23.1.2 for @nx/gradle contain a command injection caused by shell interpolation of plugin options in project-graph analyzers, letting users executing Nx in attacker-controlled repositories run arbitrary commands with their privileges, exploit requires running Nx in a malicious repository or pull request.

  • 7.8 /10 High
    CVE-2026-119250 Auth required

    WiFiman Desktop - Command Injection

    WiFiman Desktop for macOS contains an external control of file name or path vulnerability caused by improper handling of file paths, letting local attackers with low privileges execute arbitrary commands with root privileges, exploit requires local access.

  • 7.5 /10 High
    CVE-2026-119249 No auth

    WiFiman Desktop - Information Disclosure

    WiFiman Desktop for macOS contains a binding to an unrestricted IP address vulnerability, letting network attackers obtain information about the host device, exploit requires network access.

  • 7.1 /10 High
    CVE-2026-119208 No auth

    pypdf - Denial of Service

    pypdf < 6.21.3 contains a denial of service caused by trusting unvalidated /Count value in the page tree of crafted encrypted PDFs, letting attackers cause excessive time and memory consumption, exploit requires crafted PDF.

  • 7.1 /10 High
    CVE-2026-119207 No auth

    pypdf - Denial of Service

    pypdf < 6.21.3 contains an information disclosure caused by nested parsing failures adding repeated exception text when strict mode loads crafted invalid PDF dictionaries, letting attackers cause excessive memory consumption remotely, exploit requires crafted PDF input.

  • 7.1 /10 High
    CVE-2026-119206 No auth

    pypdf - Denial of Service

    pypdf < 6.21.3 contains a denial of service caused by inefficient page label retrieval from crafted PDFs with many label ranges, letting attackers cause excessive processing delays, exploit requires crafted PDF input.

  • 7.1 /10 High
    CVE-2026-119205 No auth

    pypdf - Denial of Service

    pypdf < 6.21.4 contains an infinite loop vulnerability caused by improper clone traversal of cyclic DictionaryObject, letting attackers cause denial of service via crafted PDFs, exploit requires crafted cyclic DictionaryObject.

  • 7.1 /10 High
    CVE-2026-119204 No auth

    pypdf - Denial of Service

    pypdf < 6.21.4 contains a denial of service caused by excessive memory consumption during parsing of crafted PDF page trees with many shared resources, letting attackers cause resource exhaustion, exploit requires crafted PDF input.

  • 7.1 /10 High
    CVE-2026-119203 No auth

    pypdf - Denial of Service

    pypdf < 6.21.4 contains a denial of service caused by infinite loop when opening crafted incomplete PDFs with cross-reference tables ending without a trailer, letting attackers block processing thread, exploit requires crafted PDF input.

  • 7.5 /10 High
    CVE-2026-119202 No auth

    @hapi/content - Denial of Service

    @hapi/content 3.0.6 to < 6.0.3 contains a denial of service caused by unanchored parameter-name regex in Content.disposition(), letting attackers block Node.js event loop via crafted Content-Disposition headers, exploit requires untrusted header input.

  • 7.5 /10 High
    CVE-2026-119197 No auth

    pyasn1 - Denial of Service

    pyasn1 < 0.6.5 contains a denial of service caused by quadratic time complexity in binary REAL decoding in RealPayloadDecoder.valueDecoder, letting attackers cause availability loss by crafting large mantissa values, exploit requires attacker-controlled ASN.1 input.

  • 7.5 /10 High
    CVE-2026-119196 No auth

    pyasn1 - Denial of Service

    pyasn1 < 0.6.5 contains a denial of service caused by quadratic CPU exhaustion during constructed BIT STRING decoding with attacker-controlled fragmented input, letting attackers exhaust CPU resources, exploit requires crafted BER or CER input.

  • 7.5 /10 High
    CVE-2026-119195 No auth

    pyasn1 - Denial of Service

    pyasn1 < 0.6.5 contains a denial of service caused by quadratic complexity in constructed string and indefinite-length ANY decoding, letting attackers exhaust CPU by sending crafted fragmented BER or CER data, exploit requires attacker to send crafted ASN.1 data.

  • 7.5 /10 High
    CVE-2026-119194 No auth

    pyasn1 - Denial of Service

    pyasn1 0.3.3 to < 0.6.5 contains a denial of service caused by quadratic CPU consumption due to TagSet hash collisions in schemaless container decoding, letting attackers exhaust CPU resources, exploit requires crafted BER, CER, or DER input.

  • 7.5 /10 High
    CVE-2026-119191 PoC publicNo auth

    Forge - Denial of Service

    Forge (node-forge) < 1.4.1 contains a denial of service caused by excessive recursion and quadratic memory consumption in asn1.fromDer() BIT STRING decoding, letting attackers cause high CPU and memory use, exploit requires crafted DER input.