Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 43 of 891
- 7.4 /10 HighCVE-2026-119190
Forge - Authentication Bypass
Forge (node-forge) < 1.4.1 contains a broken authentication caused by improper parsing of deprecated extension OIDs in certificate verification, letting attackers with a trusted CA issue unauthorized CA certificates, exploit requires a trusted CA to issue crafted certificates.
- 7.5 /10 HighCVE-2026-119188 No auth
Forge - Denial of Service
Forge (node-forge) < 1.4.1 contains a denial of service caused by continued processing of fragmented handshake messages after interruption by another TLS record type, letting remote peers cause connection failure, exploit requires network access.
- 7.5 /10 HighCVE-2026-119187 PoC publicNo auth
Forge - Denial of Service
Forge (node-forge) < 1.4.1 contains a denial of service caused by recursive processing of TLS records in forge.tls.createConnection(), letting remote attackers exhaust the call stack, exploit requires sending many small TLS records.
- 8.8 /10 HighCVE-2026-119168 Auth required
HashiCorp Nomad - Privilege Escalation
HashiCorp Nomad and Nomad Enterprise < 2.1.0, 1.11.12, 1.10.18 contain a symlink following vulnerability during same-client allocation data migration, letting malicious workloads change host directory permissions and ownership, potentially leading to privilege escalation, exploit requires malicious workload execution.
- 9.9 /10 CriticalCVE-2026-119145 Auth required
Frappe - Path Traversal
Frappe < 15.121.0 and 16.x < 16.34.0 contain a path traversal caused by improper validation of destination path in file-upload handling, letting authenticated attackers achieve remote code execution by uploading crafted files outside intended directories.
- 8.8 /10 HighCVE-2026-119144 Auth required
Frappe Framework - Server-Side Template Injection
Frappe Framework < 15.111.0 and 16.x < 16.21.0 contains a server-side template injection caused by rendering user-controlled message fields as templates without neutralization, letting authenticated attackers with common operational roles execute arbitrary server-side code.
- 8.1 /10 HighCVE-2026-119129 No auth
ZITADEL - Broken Access Control
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contain a broken access control vulnerability in Login V2 caused by missing authorization checks, letting attackers approve OAuth 2.0 device authorizations using a victim's session without consent, exploit requires victim to be signed in.
- 7.4 /10 HighCVE-2026-119128 No auth
ZITADEL - Authentication Bypass
ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass caused by a flaw in the Login V2 UI allowing unauthenticated attackers to set the first credential for users without authentication methods, letting attackers take over accounts by computing a valid verificationCheck cookie from user ID and browser fingerprint.
- 8.1 /10 HighCVE-2026-119127 No auth
ZITADEL - Host Header Injection
ZITADEL < 4.19.5 contains a host header injection caused by untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers in Login V2 UI, letting unauthenticated attackers poison email links and take over accounts.
- 7.5 /10 HighCVE-2026-119120 Auth required
Crawl4AI - Command Injection
Crawl4AI 0.9.0 before 0.9.5 contains a command injection caused by unfiltered model_name field in CosineStrategy in Docker API request bodies, letting authenticated clients execute arbitrary Python code or exhaust resources.
- 7.5 /10 HighCVE-2026-119119 No auth
Crawl4AI - Denial of Service
Crawl4AI < 0.9.5 contains a denial of service caused by failure to cap delay_before_return_html, mean_delay, and max_range fields in untrusted CrawlerRunConfig bodies in Docker API server, letting unauthenticated attackers exhaust page pool and block crawls, exploit requires unauthenticated access to /crawl or /crawl/stream endpoints.
- 8.5 /10 HighCVE-2026-119115 Auth required
AWS Private CA Connector for Kubernetes - Broken Access Control
AWS Private CA Connector for Kubernetes (aws-privateca-issuer) < v1.10.1 contains an authorization bypass caused by incorrect issuer resolution logic, letting authenticated remote users obtain unauthorized certificates, exploit requires authenticated access.
- 7.5 /10 HighCVE-2026-119052 No auth
llama.cpp - Denial of Service
llama.cpp before b11935 contains a denial of service caused by uncaught exception in ggml-rpc server when unauthenticated remote attackers send oversized message lengths after HELLO handshake, letting attackers crash the rpc-server.
- 8.1 /10 HighCVE-2026-119050
Agno - Unsafe Reflection
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools caused by use of getattr() with model-controlled function names, letting attackers execute code or read local files via prompt injection, exploit requires attacker-controlled input.
- 7.6 /10 HighCVE-2026-119049 Auth required
FreeMail - Authorization Bypass
FreeMail < 5.3.2 contains an authorization bypass caused by improper access control in the POST /api/create endpoint, letting authenticated users claim other users' mailboxes and access their messages, exploit requires authentication.