Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 365 of 767

  • 7.5 /10 High
    CVE-2026-103880 No auth

    Apache Directory LDAP API - Denial of Service

    Apache Directory LDAP API 2.1.0 to < 2.1.9 contains an asymmetric resource consumption vulnerability caused by bcrypt password hashing with high cost factor, letting attackers cause server CPU exhaustion and denial of service, exploit requires crafted password with high bcrypt cost.

  • 7.5 /10 High
    CVE-2026-103878 No auth

    Apache Directory LDAP API - Cleartext Transmission

    Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains a cleartext transmission vulnerability caused by StartTLS extended operation starting after a Search request, letting attackers intercept data in plain text before TLS handshake completion, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-103877

    Apache Directory LDAP API - Insecure Deserialization

    Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains an insecure deserialization vulnerability caused by processing serialized Java classes in schema objects from untrusted LDAP servers, letting attackers achieve potential remote code execution, exploit requires a rogue or compromised LDAP server or pre-TLS man-in-the-middle.

  • 7.2 /10 High
    CVE-2026-103766 Auth required

    ClipBucket - SQL Injection

    ClipBucket v5 through 5.5.3-#197 contains an SQL injection caused by improper sanitization of the delete parameter in admin_area/ads_manager.php, letting authenticated users with ad_manager_access inject SQL to extract or modify data.

  • 9.4 /10 Critical
    CVE-2026-103765 No auth

    Mooncake - Authentication Bypass

    Mooncake <= 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler, letting unauthenticated attackers read, overwrite, and delete transfer engine metadata keys, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-103764 No auth

    Mooncake transfer engine - Remote Code Execution & Information Disclosure

    Mooncake transfer engine < 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader, letting unauthenticated attackers read and write arbitrary process memory via TCP transport data port, exploit requires crafted SessionHeader with arbitrary addr and size values.

  • 9.1 /10 Critical
    CVE-2026-103648 PoC publicNo auth

    image-downloader - Path Traversal

    image-downloader 4.3.0 contains a path traversal caused by uncontrolled download URL, letting attackers write downloaded response data outside the configured destination directory, exploit requires control over download URL.

  • 8.8 /10 High
    CVE-2026-103631 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 154.0.8037.97 contains a buffer overflow in WebRTC, caused by improper handling of data, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-103630 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free caused by improper memory handling in FedCM, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-103628 No auth

    Google Chrome - Out of Bounds Write

    Google Chrome < 154.0.8037.97 contains an out of bounds write in WebGL caused by improper bounds checking, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-103626 No auth

    Google Chrome - Broken Access Control

    Google Chrome on Windows < 154.0.8037.97 contains a broken access control caused by incorrect authorization in FileSystem, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 8.8 /10 High
    CVE-2026-103625 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 154.0.8037.97 contains a remote code execution caused by type confusion in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-103624

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free vulnerability in Contextual Tasks, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-103623 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free caused by improper memory handling in MediaStream, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-103622 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.97 contains a use after free vulnerability in SVG, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.