Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 258 of 695

  • 8.3 /10 High
    CVE-2026-106194

    Google Chrome - Broken Access Control

    Google Chrome < 155.0.8059.39 contains a broken access control caused by missing authorization in WebAppInstalls, letting remote attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page, exploit requires social engineering.

  • 8.8 /10 High
    CVE-2026-106193 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free caused by improper memory handling in the Parser, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-106191 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 155.0.8059.39 contains a broken access control caused by missing authorization in Actor, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page.

  • 8.8 /10 High
    CVE-2026-106190 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability in Media, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.3 /10 High
    CVE-2026-106189 No auth

    Google Chrome - Stored XSS

    Google Chrome on iOS < 155.0.8059.39 contains a code injection vulnerability in ReaderMode caused by improper handling of crafted HTML pages, letting remote attackers bypass web origin policy via social engineering.

  • 7.1 /10 High
    CVE-2026-106188 No auth

    Google Chrome - Broken Access Control

    Google Chrome on Android < 155.0.8059.39 contains a broken access control caused by confused deputy issue in SignIn, letting remote attackers bypass system access restrictions into privileged pages via crafted HTML, exploit requires crafted HTML page.

  • 8.6 /10 High
    CVE-2026-106186 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains an uncontrolled search path element vulnerability in CredentialProvider, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 7.5 /10 High
    CVE-2026-106122 PoC public

    RabbitMQ Java client library - Denial of Service

    RabbitMQ Java client library < 5.36.0 contains an unchecked exception caused by malformed UTF-8 bytes in RPC message properties in ValueReader.readShortstr, letting attackers cause denial of service by disabling consumers, exploit requires ability to submit crafted RPC messages.

  • 7.5 /10 High
    CVE-2026-106118 No auth

    ImageSharp - Out of Bounds Read/Write

    ImageSharp 3.0.0 to 4.1.1 contains a heap corruption vulnerability caused by out-of-bounds writes in tiled TIFF decoding due to buffer size mismatch, letting attackers cause process termination, exploit requires crafted TIFF files.

  • 7.5 /10 High
    CVE-2026-106117 No auth

    ImageSharp - Buffer Overflow

    ImageSharp 3.0.0 to 4.1.1 contains a buffer overflow caused by unchecked writes in TIFF strip decoding with CCITT Group 3 or Modified Huffman compression, letting attackers cause heap corruption and process termination, exploit requires crafted TIFF image.

  • 7.5 /10 High
    CVE-2026-106115 No auth

    ImageSharp - Buffer Overflow

    ImageSharp 2.1.0 to 4.1.2 contains a buffer overflow caused by unchecked writes in TIFF CCITT Group 4 encoder's TiffCcittCompressor.WriteCode, letting attackers cause memory corruption and process termination, exploit requires attacker-supplied input with specific metadata.

  • 7.5 /10 High
    CVE-2026-106113 No auth

    ImageSharp - Buffer Overflow

    ImageSharp 2.0.0 to 4.1.2 contains a buffer overflow caused by unchecked histogram offset from non-finite luminance values during HistogramEqualization on 32-bit floating-point TIFF images, letting attackers cause process termination, exploit requires crafted TIFF input.

  • 7.5 /10 High
    CVE-2026-106112 No auth

    ImageSharp - Denial of Service

    ImageSharp 4.0.0 to 4.1.2 contains a memory corruption vulnerability caused by ICC LUT16 conversion accepting more than four output channels, letting attackers cause process termination via malformed embedded profiles, exploit requires ICC conversion enabled.

  • 7.5 /10 High
    CVE-2026-106110

    ImageSharp - Out of Bounds Read/Write

    ImageSharp 2.0.0 to 4.1.2 contains a buffer overflow caused by undersized compressed-data buffer allocation in TIFF CCITT Group 3 encoder, letting attackers corrupt memory and cause process termination, exploit requires attacker-controlled encode or decode-and-re-encode flow.

  • 8.3 /10 High
    CVE-2026-106107 No auth

    Quasar Framework - Stored XSS

    Quasar Framework < 3.3.0 contains a stored XSS caused by direct interpolation of ssrContext.nonce into quoted HTML attributes in SSR and SSG rendering paths, letting attackers inject arbitrary HTML attributes or markup, exploit requires attacker-controlled nonce value.