Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 44 of 891
- 8.8 /10 HighCVE-2026-119028
oapi-codegen - Code Injection
oapi-codegen < 2.8.1 contains a code injection vulnerability caused by non-literal enum entries in integer, number, or boolean schemas, letting attackers inject Go code executed during package build, exploit requires attacker to control OpenAPI document.
- 7.5 /10 HighCVE-2026-119027 No auth
oapi-codegen - Code Injection
oapi-codegen > 2.5.0 and < 2.8.1 contains a code injection vulnerability caused by unescaped servers[].x-go-name value in server-urls template, letting attackers inject Go code executed during package build, exploit requires attacker control of OpenAPI document.
- 7.5 /10 HighCVE-2026-119025 PoC publicNo auth
Open - Command Injection
Open 7.2.0 < 11.0.0 contains an OS command injection caused by unescaped PowerShell command execution from crafted URLs in index.js, letting attackers execute arbitrary PowerShell code remotely, exploit requires crafted URL input.
- 7.5 /10 HighCVE-2026-118782 No auth
Forge - Authentication Bypass
Forge (node-forge) < 1.4.1 contains a broken authentication caused by accepting PKCS#12 MAC or password-based encryption iteration count of zero or less, letting attackers bypass password-based integrity checks with crafted input, exploit requires crafted PKCS#12 input.
- 7.5 /10 HighCVE-2026-118779 No auth
Forge - Denial of Service
Forge (node-forge) < 1.4.1 contains a denial of service caused by polynomial-time regular expressions in pem.decode() missing END line checks, letting unauthenticated attackers cause excessive CPU consumption with malformed PEM input.
- 7.5 /10 HighCVE-2026-118772 No auth
Joi - Denial of Service
Joi 17.1.1 to 17.13.9 and 18.3.1 contain a denial of service caused by inefficient regex processing in string().email({ multiple: true }) rule, letting attackers block the Node.js event loop, exploit requires attacker-controlled input with multiple option and no effective length limit.
- 9.2 /10 CriticalCVE-2026-118769 No auth
Botan - Buffer Overflow
Botan 2.1.0 to 3.13.0 contains a buffer overflow caused by unchecked conversion of block size from size_t to int in botan_block_cipher_block_size function, letting attackers cause memory corruption via crafted algorithm parameters in raw ECB mode, exploit requires use of FFI raw ECB mode with external algorithm parameters.
- 7.3 /10 HighCVE-2026-118765 Auth required
Botan - Weak Cryptography
Botan 3.7.0 to 3.13.0 contains a weak random number generator seeding caused by calling AutoSeeded_RNG::clear() followed by randomize with an empty buffer while unseeded, letting attackers predict RNG output, exploit requires unseeded RNG state.
- 7.4 /10 HighCVE-2026-118763 No auth
sigstore-js - Information Disclosure
sigstore-js < 0.7.2 contains an information disclosure caused by RegistryClient.uploadBlob() sending authentication headers to attacker-controlled hosts, letting malicious registries steal bearer tokens and credentials, exploit requires interaction with a malicious registry.
- 9.3 /10 CriticalCVE-2026-118762 No auth
Monkeytype - Remote Code Execution
Monkeytype < 26.43.0 contains a remote code execution caused by elevated GITHUB_TOKEN persistence in CI workflow on pull_request_target, letting external contributors execute arbitrary code and modify repository content, exploit requires pull request with format label.
- 7.5 /10 HighCVE-2026-118761 No auth
Kubeflow Pipelines - Denial of Service
Kubeflow Pipelines < 2.18.0 contains a denial of service caused by unbounded decompression of uploaded pipeline archives in the API server, letting reachable callers exhaust memory and resources without authorization, exploit requires sending crafted compressed archives.
- 7.5 /10 HighCVE-2026-118759
Kubeflow Pipelines - Broken Access Control
Kubeflow Pipelines < 2.18.0 contains an information disclosure caused by missing authorization in the API server's log retrieval handler, letting attackers with backend access read logs of arbitrary runs and pods, exploit requires backend access and knowledge of run and node IDs.
- 7.5 /10 HighCVE-2026-118758 No auth
Kubeflow Pipelines - Path Traversal
Kubeflow Pipelines < 2.18.0 contains a path traversal vulnerability caused by insufficient confinement of caller-supplied file paths in the volume artifact handler, letting attackers read files outside the selected volume, exploit requires access to the artifact GET route and volume identification.
- 7.1 /10 HighCVE-2026-118085 No auth
GlobalPayments WooCommerce - Reflected XSS
GlobalPayments WooCommerce <= 1.23.3 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 7.5 /10 HighCVE-2026-118083 No auth
WP Crowdfunding - Information Disclosure
WP Crowdfunding <= 2.2.2 contains an information disclosure caused by unauthenticated access to sensitive data, letting unauthenticated attackers access sensitive information remotely, exploit requires no authentication.