Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 8 of 891

  • 7.4 /10 High
    CVE-2026-120459 No auth

    python-jose - Authentication Bypass

    python-jose <= 3.5.0 contains an authentication bypass caused by acceptance of zero-length HMAC secrets in HMACKey and CryptographyHMACKey, letting unauthenticated attackers forge JWTs with arbitrary claims, exploit requires empty verification key.

  • 8.1 /10 High
    CVE-2026-120448 Auth required

    DoraCMS - Broken Access Control

    DoraCMS <= 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint, letting authenticated low-privileged users rebind API keys to other users, enabling profile modification and content control.

  • 8.1 /10 High
    CVE-2026-120447 No auth

    HotGo - Authentication Bypass

    HotGo <= 2.15.1 contains an authentication bypass caused by unauthenticated attackers setting SMS login verification codes via /admin/sms/send, letting attackers take over user accounts including administrators, exploit requires knowledge of user's mobile number.

  • 9.4 /10 Critical
    CVE-2026-120446 No auth

    madong-admin-saas - Authentication Bypass

    madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.

  • 8.8 /10 High
    CVE-2026-120445 Auth required

    madong-admin-saas - Broken Access Control

    madong-admin-saas <= 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware, letting authenticated tenant users access platform management API, create admin accounts, and control tenants, exploit requires tenant user authentication.

  • 8.1 /10 High
    CVE-2026-120444 No auth

    GoFound - Path Traversal

    GoFound <= 1.4.1 contains a path traversal vulnerability caused by improper sanitization of the database parameter in /api/db/create and /api/db/drop endpoints, letting unauthenticated attackers delete arbitrary directories.

  • 9.8 /10 Critical
    CVE-2026-120442

    ape-volo-admin - Authentication Bypass

    ape-volo-admin < 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key.

  • 7.0 /10 High
    CVE-2026-120439 No auth

    QuickJS-NG - Integer Overflow

    QuickJS-NG < 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c, letting attackers running JavaScript cause heap buffer overflow on 32-bit hosts by sorting large typed arrays with a comparator.

  • 7.8 /10 High
    CVE-2026-120438 Auth required

    QuickJS-NG - Integer Overflow

    QuickJS-NG < 0.16.0 contains an integer overflow caused by improper handling in js_proxy_get_own_property_names() in quickjs.c, letting attackers running JavaScript cause heap buffer overflow and potential code execution, exploit requires attacker to run JavaScript code.

  • 7.8 /10 High
    CVE-2026-120436 No auth

    Netpbm - Integer Overflow

    Netpbm < 10.86.51, 11.x < 11.02.30, and 11.03 < 11.15.08 contain an integer overflow in jbigtopnm causing a heap buffer overflow in jbg_dec_merge_planes(), letting attackers execute code or cause crashes via crafted multi-plane JBIG files.

  • 7.8 /10 High
    CVE-2026-120435 No auth

    Netpbm - Buffer Overflow

    Netpbm < 10.86.51, 11.x < 11.02.30, and 11.03 < 11.15.08 contain a heap buffer overflow caused by unvalidated characters-per-pixel value in the XPM header in xpmtoppm, letting attackers execute code or cause crashes via crafted XPM files.

  • 7.8 /10 High
    CVE-2026-120434 No auth

    Netpbm - Buffer Overflow

    Netpbm < 10.86.51, 11.x < 11.02.30, and 11.03 < 11.15.08 contain a stack-based buffer overflow caused by polygon edges exceeding 5000 points in picttoppm's scanPoly() function, letting attackers crash the converter or execute code remotely, exploit requires crafted PICT file.

  • 7.8 /10 High
    CVE-2026-120433 No auth

    Netpbm - Buffer Overflow

    Netpbm < 10.86.51, 11.x < 11.02.30, and 11.03 < 11.15.08 contain a stack-based buffer overflow caused by unbounded polygon point count in picttoppm paintPoly() function, letting attackers execute code or cause crashes via crafted PICT files, exploit requires crafted file input.

  • 7.8 /10 High
    CVE-2026-120432 No auth

    Netpbm - Integer Overflow

    Netpbm < 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow caused by oversized ICO/CUR dimensions in winicontopam, letting attackers corrupt heap memory and potentially execute code, exploit requires crafted icon file.

  • 7.8 /10 High
    CVE-2026-120431 No auth

    Netpbm - Buffer Overflow

    Netpbm < 10.86.51, 11.x < 11.02.29, and 11.03 < 11.15.07 contain a heap-based buffer overflow caused by improper handling of oversized offset table lengths in sgitopnm's readChannels() function, letting attackers execute code or cause crashes via crafted SGI files, exploit requires crafted SGI image files.