Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 330 of 767

  • 8.8 /10 High
    CVE-2026-106190 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability in Media, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 7.3 /10 High
    CVE-2026-106189 No auth

    Google Chrome - Stored XSS

    Google Chrome on iOS < 155.0.8059.39 contains a code injection vulnerability in ReaderMode caused by improper handling of crafted HTML pages, letting remote attackers bypass web origin policy via social engineering.

  • 7.1 /10 High
    CVE-2026-106188 No auth

    Google Chrome - Broken Access Control

    Google Chrome on Android < 155.0.8059.39 contains a broken access control caused by confused deputy issue in SignIn, letting remote attackers bypass system access restrictions into privileged pages via crafted HTML, exploit requires crafted HTML page.

  • 8.6 /10 High
    CVE-2026-106186 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains an uncontrolled search path element vulnerability in CredentialProvider, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 7.5 /10 High
    CVE-2026-106122 PoC public

    RabbitMQ Java client library - Denial of Service

    RabbitMQ Java client library < 5.36.0 contains an unchecked exception caused by malformed UTF-8 bytes in RPC message properties in ValueReader.readShortstr, letting attackers cause denial of service by disabling consumers, exploit requires ability to submit crafted RPC messages.

  • 7.5 /10 High
    CVE-2026-106118 No auth

    ImageSharp - Out of Bounds Read/Write

    ImageSharp 3.0.0 to 4.1.1 contains a heap corruption vulnerability caused by out-of-bounds writes in tiled TIFF decoding due to buffer size mismatch, letting attackers cause process termination, exploit requires crafted TIFF files.

  • 7.5 /10 High
    CVE-2026-106117 No auth

    ImageSharp - Buffer Overflow

    ImageSharp 3.0.0 to 4.1.1 contains a buffer overflow caused by unchecked writes in TIFF strip decoding with CCITT Group 3 or Modified Huffman compression, letting attackers cause heap corruption and process termination, exploit requires crafted TIFF image.

  • 7.5 /10 High
    CVE-2026-106115 No auth

    ImageSharp - Buffer Overflow

    ImageSharp 2.1.0 to 4.1.2 contains a buffer overflow caused by unchecked writes in TIFF CCITT Group 4 encoder's TiffCcittCompressor.WriteCode, letting attackers cause memory corruption and process termination, exploit requires attacker-supplied input with specific metadata.

  • 7.5 /10 High
    CVE-2026-106113 No auth

    ImageSharp - Buffer Overflow

    ImageSharp 2.0.0 to 4.1.2 contains a buffer overflow caused by unchecked histogram offset from non-finite luminance values during HistogramEqualization on 32-bit floating-point TIFF images, letting attackers cause process termination, exploit requires crafted TIFF input.

  • 7.5 /10 High
    CVE-2026-106112 No auth

    ImageSharp - Denial of Service

    ImageSharp 4.0.0 to 4.1.2 contains a memory corruption vulnerability caused by ICC LUT16 conversion accepting more than four output channels, letting attackers cause process termination via malformed embedded profiles, exploit requires ICC conversion enabled.

  • 7.5 /10 High
    CVE-2026-106110

    ImageSharp - Out of Bounds Read/Write

    ImageSharp 2.0.0 to 4.1.2 contains a buffer overflow caused by undersized compressed-data buffer allocation in TIFF CCITT Group 3 encoder, letting attackers corrupt memory and cause process termination, exploit requires attacker-controlled encode or decode-and-re-encode flow.

  • 8.3 /10 High
    CVE-2026-106107 No auth

    Quasar Framework - Stored XSS

    Quasar Framework < 3.3.0 contains a stored XSS caused by direct interpolation of ssrContext.nonce into quoted HTML attributes in SSR and SSG rendering paths, letting attackers inject arbitrary HTML attributes or markup, exploit requires attacker-controlled nonce value.

  • 7.1 /10 High
    CVE-2026-106106 No auth

    Quasar Framework - Stored XSS & Information Disclosure

    Quasar Framework prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 contains a stored XSS caused by improper escaping of diagnostic data in renderSSRError(), letting network-adjacent attackers execute script in developer browsers and access environment secrets, exploit requires attacker to reach SSR or SSG render failure on development server.

  • 8.4 /10 High
    CVE-2026-106105

    Quasar Framework - Information Disclosure

    Quasar Framework prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0 contains an information disclosure vulnerability caused by improper filesystem permissions on cached private key and certificate PEM, letting local attackers impersonate development TLS endpoints, exploit requires local user access to cache files.

  • 8.7 /10 High
    CVE-2026-106104 No auth

    Quasar Framework - Denial of Service

    Quasar Framework < 2.23.3 contains a denial of service caused by unbounded User-Agent header parsing in Platform.parseSSR(), letting unauthenticated attackers block the Node.js event loop, exploit requires crafted repeated version tokens in User-Agent header.