Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 769 of 891
- 8.8 /10 HighCVE-2026-91200 No auth
DevSpace - Path Traversal & Remote Code Execution
DevSpace <= 6.3.21 contains a path traversal vulnerability caused by failure to reject parent-directory segments in tar entry names from the in-pod sync stream, letting attackers operating malicious containers write arbitrary files and execute code on the developer workstation, exploit requires attacker to control a container.
- 7.1 /10 HighCVE-2026-91145 Auth required
Activiti - Expression Language Injection
Activiti <= 7.1.0.M6 contains an expression injection vulnerability caused by failure to validate hash-brace deferred expressions in process variables, letting attackers inject and execute expressions in mail task body fields, exploit requires crafted process variables.
- 7.5 /10 HighCVE-2026-91144 No auth
ZFile - Broken Access Control
ZFile <= 5.0.5 contains a broken access control caused by insufficient validation of file paths on the download endpoint, letting attackers with a share link download arbitrary files under the shared base directory, exploit requires attacker to have a valid share link.
- 7.2 /10 HighCVE-2026-91143 No auth
goproxy - Broken Access Control
goproxy through 15.3 contains a broken access control vulnerability caused by failure to apply HTTP proxy basic authentication to CONNECT tunnel requests, letting unauthenticated clients relay arbitrary TCP traffic and access restricted destinations, exploit requires no special privileges.
- 7.5 /10 HighCVE-2026-91080 No auth
Webhook - Denial of Service
Webhook <= 2.8.3 contains a denial of service caused by reading entire request bodies into memory before evaluating trigger rules, letting unauthenticated attackers exhaust memory and crash the service, exploit requires sending oversized request bodies.
- 8.5 /10 HighCVE-2026-91079 Auth required
Huly Platform - Server-Side Request Forgery
Huly Platform through 0.7.426 contains a server-side request forgery caused by missing hostname allowlist validation in the print service, letting authenticated workspace members access internal metadata services and network hosts by supplying arbitrary URLs.
- 7.8 /10 HighCVE-2026-90949 No auth
GIMP - Buffer Overflow
GIMP contains a heap-based buffer overflow caused by a size mismatch in the PSP file loader's compressed selection channel processing, letting remote attackers execute arbitrary code by opening a crafted PSP file.
- 7.8 /10 HighCVE-2026-90948 No auth
GIMP - Remote Code Execution
GIMP contains a heap-based buffer overflow caused by an integer overflow in ICO file loader during buffer size calculation for embedded PNG images, letting remote attackers execute arbitrary code or cause a crash, exploit requires opening a crafted ICO file.
- 7.8 /10 HighCVE-2026-90947 No auth
GIMP - Remote Code Execution
GIMP contains a buffer overflow caused by improper validation of the number of light sources in a specially crafted lighting preset file, letting attackers execute arbitrary code by convincing users to open malicious files.
- 7.5 /10 HighCVE-2026-90946 No auth
DeepWiki-Open - Arbitrary File Read
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability caused by lack of path containment in the unauthenticated /ws/chat WebSocket endpoint, letting attackers read sensitive files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-90945 No auth
Crawlab - Authentication Bypass
Crawlab <= 0.6.3 contains a broken authentication caused by hard-coded HMAC-SHA256 secret for JWT token signing, letting unauthenticated attackers forge admin tokens to access APIs and execute code on worker nodes, exploit requires no special privileges.
- 8.2 /10 HighCVE-2026-90944 No auth
Krayin CRM - Authentication Bypass
Krayin CRM <= 2.2.6 contains an authentication bypass caused by unauthenticated access to the POST /admin/mail/inbound-parse endpoint, letting unauthenticated attackers inject arbitrary emails into the CRM inbox, exploit requires no authentication.
- 8.7 /10 HighCVE-2026-90943 Auth required
Parallax filament-comments - Stored XSS
Parallax filament-comments <= 3.0.0 contains a stored XSS caused by improper sanitization in comment body rendering, letting authenticated panel users inject malicious scripts that execute in other users' browsers.
- 9.6 /10 CriticalCVE-2026-90942 Auth required
Casdoor - Authentication Bypass
Casdoor through 4.4.0 contains an information disclosure caused by improper masking of the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, letting organization administrators retrieve the private key, exploit requires organization administrator privileges.
- 8.6 /10 HighCVE-2026-90938 No auth
LangBot langbot_plugin - Authentication Bypass
LangBot langbot_plugin <= 0.4.17 contains an authentication bypass caused by default empty plugin_debug_key on debug WebSocket server, letting remote attackers register debug plugins and access sensitive IM events, exploit requires network access to port 5401.