Threat Heartbeat
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 11502
- Critical
- 2091
- CISA KEV
- 92
- Public PoC
- 393
Most common types
- Broken Access Control 1499
- Remote Code Execution 1456
- Privilege Escalation 1227
- Authentication Bypass 940
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026
Latest CVEs
Newest first · severity as published by the vendor or NVD · page 331 of 767
- 7.1 /10 HighCVE-2026-106103 No auth
Quasar Framework @quasar/icongenie - Path Traversal
Quasar Framework @quasar/icongenie < 6.1.1 contains a path traversal caused by insufficient validation of folder and name values in user-supplied profiles, letting developers overwrite arbitrary writable files, exploit requires running crafted profile.
- 10.0 /10 CriticalCVE-2026-106102 No auth
Quasar Framework - Stored XSS
Quasar Framework < 2.22.0 contains a stored XSS caused by improper encoding in the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js, letting attackers inject executable markup via dynamic page metadata, exploit requires attacker control over metadata.
- 7.1 /10 HighCVE-2026-106100 Auth required
Payload @payloadcms/db-mongodb - Broken Access Control
Payload @payloadcms/db-mongodb < 3.87.0 and < 4.0.0-canary.20 contains a broken access control vulnerability caused by improper enforcement of field-level write permissions, letting authenticated users modify restricted fields, exploit requires authenticated user with document update permissions.
- 7.8 /10 HighCVE-2026-106062 No auth
GIMP - Buffer Overflow
GIMP contains a heap-based buffer overflow caused by integer overflow in size calculations in the DirectDraw Surface (DDS) loader, letting attackers execute arbitrary code via crafted DDS images, exploit requires crafted image input.
- 8.2 /10 HighCVE-2026-106040
Mooncake Store - Broken Access Control
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability in EvictDiskReplica and BatchEvictDiskReplica, letting unauthenticated attackers erase disk replicas across tenants, exploit requires access to coro_rpc master port.
- 8.2 /10 HighCVE-2026-106038 No auth
Mooncake Store - Authentication Bypass
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability caused by lack of authentication on coro_rpc port methods, letting unauthenticated attackers force-delete any object, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-106037 No auth
Mooncake - Authentication Bypass
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service binding to 0.0.0.0, letting unauthenticated attackers read, inject, delete cached KV data, and mount segments, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-106016 No auth
Firefox - Mitigation Bypass
Firefox contains a mitigation bypass caused by a flaw in the File Handling component, letting attackers bypass security mitigations, exploit requires no special conditions.
- 8.8 /10 HighCVE-2026-105985 Auth required
Craft CMS - Remote Code Execution
Craft CMS 5.10.13.2 contains an authenticated remote code execution caused by unsandboxed Twig template evaluation in Control Panel action app/render-components, letting authenticated users execute OS commands with web server privileges, exploit requires basic Control Panel access.
- 7.3 /10 HighCVE-2026-105920 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection caused by manipulation in student_signup.php Student Registration Endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.
- 7.3 /10 HighCVE-2026-105919 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System contains a SQL injection caused by manipulation of username/password arguments in admin/login.php Administrator Login Endpoint, letting remote attackers execute arbitrary SQL queries, exploit requires crafted input.
- 7.3 /10 HighCVE-2026-105918 No auth
Kusalkasilva Learning-Management-System - SQL Injection
Kusalkasilva Learning-Management-System contains a SQL injection caused by manipulation of username/password arguments in login.php login endpoint, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 7.1 /10 HighCVE-2026-105868 No auth
Payload - Stored XSS
Payload < 3.90.0 and canary < 4.0.0-canary.34 contain a stored XSS caused by local upload configurations accepting XML files with stylesheets, letting logged-in users execute JavaScript in the Payload origin, exploit requires user to be logged in.
- 7.5 /10 HighCVE-2026-105866 No auth
Payload - Authentication Bypass
Payload before 3.90.0 and canary versions before 4.0.0-canary.34 contain an account lockout abuse vulnerability caused by improper handling of local-authentication collections, letting unauthenticated attackers prevent account sign-in by triggering lockout, exploit requires knowledge of account email or username.
- 8.1 /10 HighCVE-2026-105865 Auth required
Payload - Broken Access Control
Payload before 3.90.0 and canary before 4.0.0-canary.34 contains a file cleanup vulnerability caused by improper restriction on file deletion outside the upload directory, letting authenticated users cause data loss or service disruption, exploit requires upload update or delete permissions.