Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 259 of 695
- 7.1 /10 HighCVE-2026-106106 No auth
Quasar Framework - Stored XSS & Information Disclosure
Quasar Framework prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 contains a stored XSS caused by improper escaping of diagnostic data in renderSSRError(), letting network-adjacent attackers execute script in developer browsers and access environment secrets, exploit requires attacker to reach SSR or SSG render failure on development server.
- 8.4 /10 HighCVE-2026-106105
Quasar Framework - Information Disclosure
Quasar Framework prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0 contains an information disclosure vulnerability caused by improper filesystem permissions on cached private key and certificate PEM, letting local attackers impersonate development TLS endpoints, exploit requires local user access to cache files.
- 8.7 /10 HighCVE-2026-106104 No auth
Quasar Framework - Denial of Service
Quasar Framework < 2.23.3 contains a denial of service caused by unbounded User-Agent header parsing in Platform.parseSSR(), letting unauthenticated attackers block the Node.js event loop, exploit requires crafted repeated version tokens in User-Agent header.
- 7.1 /10 HighCVE-2026-106103 No auth
Quasar Framework @quasar/icongenie - Path Traversal
Quasar Framework @quasar/icongenie < 6.1.1 contains a path traversal caused by insufficient validation of folder and name values in user-supplied profiles, letting developers overwrite arbitrary writable files, exploit requires running crafted profile.
- 10.0 /10 CriticalCVE-2026-106102 No auth
Quasar Framework - Stored XSS
Quasar Framework < 2.22.0 contains a stored XSS caused by improper encoding in the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js, letting attackers inject executable markup via dynamic page metadata, exploit requires attacker control over metadata.
- 7.1 /10 HighCVE-2026-106100 Auth required
Payload @payloadcms/db-mongodb - Broken Access Control
Payload @payloadcms/db-mongodb < 3.87.0 and < 4.0.0-canary.20 contains a broken access control vulnerability caused by improper enforcement of field-level write permissions, letting authenticated users modify restricted fields, exploit requires authenticated user with document update permissions.
- 7.8 /10 HighCVE-2026-106062 No auth
GIMP - Buffer Overflow
GIMP contains a heap-based buffer overflow caused by integer overflow in size calculations in the DirectDraw Surface (DDS) loader, letting attackers execute arbitrary code via crafted DDS images, exploit requires crafted image input.
- 8.2 /10 HighCVE-2026-106040
Mooncake Store - Broken Access Control
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability in EvictDiskReplica and BatchEvictDiskReplica, letting unauthenticated attackers erase disk replicas across tenants, exploit requires access to coro_rpc master port.
- 8.2 /10 HighCVE-2026-106038 No auth
Mooncake Store - Authentication Bypass
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability caused by lack of authentication on coro_rpc port methods, letting unauthenticated attackers force-delete any object, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-106037 No auth
Mooncake - Authentication Bypass
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service binding to 0.0.0.0, letting unauthenticated attackers read, inject, delete cached KV data, and mount segments, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-106016 No auth
Firefox - Mitigation Bypass
Firefox contains a mitigation bypass caused by a flaw in the File Handling component, letting attackers bypass security mitigations, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-105985 Auth required
Craft CMS - Remote Code Execution
Craft CMS 5.10.13.2 contains an authenticated remote code execution caused by unsandboxed Twig template evaluation in Control Panel action app/render-components, letting authenticated users execute OS commands with web server privileges, exploit requires basic Control Panel access.
- 7.3 /10 HighCVE-2026-105920 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection caused by manipulation in student_signup.php Student Registration Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105919 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System contains a SQL injection caused by manipulation of username/password arguments in admin/login.php Administrator Login Endpoint, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105918 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System contains a SQL injection caused by manipulation of username/password arguments in login.php login endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.