High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 214 of 568
- 7.5 /10 HighCVE-2026-106122 PoC public
RabbitMQ Java client library - Denial of Service
RabbitMQ Java client library < 5.36.0 contains an unchecked exception caused by malformed UTF-8 bytes in RPC message properties in ValueReader.readShortstr, letting attackers cause denial of service by disabling consumers, exploit requires ability to submit crafted RPC messages.
- 7.5 /10 HighCVE-2026-106118 No auth
ImageSharp - Out of Bounds Read/Write
ImageSharp 3.0.0 to 4.1.1 contains a heap corruption vulnerability caused by out-of-bounds writes in tiled TIFF decoding due to buffer size mismatch, letting attackers cause process termination, exploit requires crafted TIFF files.
- 7.5 /10 HighCVE-2026-106117 No auth
ImageSharp - Buffer Overflow
ImageSharp 3.0.0 to 4.1.1 contains a buffer overflow caused by unchecked writes in TIFF strip decoding with CCITT Group 3 or Modified Huffman compression, letting attackers cause heap corruption and process termination, exploit requires crafted TIFF image.
- 7.5 /10 HighCVE-2026-106115 No auth
ImageSharp - Buffer Overflow
ImageSharp 2.1.0 to 4.1.2 contains a buffer overflow caused by unchecked writes in TIFF CCITT Group 4 encoder's TiffCcittCompressor.WriteCode, letting attackers cause memory corruption and process termination, exploit requires attacker-supplied input with specific metadata.
- 7.5 /10 HighCVE-2026-106113 No auth
ImageSharp - Buffer Overflow
ImageSharp 2.0.0 to 4.1.2 contains a buffer overflow caused by unchecked histogram offset from non-finite luminance values during HistogramEqualization on 32-bit floating-point TIFF images, letting attackers cause process termination, exploit requires crafted TIFF input.
- 7.5 /10 HighCVE-2026-106112 No auth
ImageSharp - Denial of Service
ImageSharp 4.0.0 to 4.1.2 contains a memory corruption vulnerability caused by ICC LUT16 conversion accepting more than four output channels, letting attackers cause process termination via malformed embedded profiles, exploit requires ICC conversion enabled.
- 7.5 /10 HighCVE-2026-106110
ImageSharp - Out of Bounds Read/Write
ImageSharp 2.0.0 to 4.1.2 contains a buffer overflow caused by undersized compressed-data buffer allocation in TIFF CCITT Group 3 encoder, letting attackers corrupt memory and cause process termination, exploit requires attacker-controlled encode or decode-and-re-encode flow.
- 8.3 /10 HighCVE-2026-106107 No auth
Quasar Framework - Stored XSS
Quasar Framework < 3.3.0 contains a stored XSS caused by direct interpolation of ssrContext.nonce into quoted HTML attributes in SSR and SSG rendering paths, letting attackers inject arbitrary HTML attributes or markup, exploit requires attacker-controlled nonce value.
- 7.1 /10 HighCVE-2026-106106 No auth
Quasar Framework - Stored XSS & Information Disclosure
Quasar Framework prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 contains a stored XSS caused by improper escaping of diagnostic data in renderSSRError(), letting network-adjacent attackers execute script in developer browsers and access environment secrets, exploit requires attacker to reach SSR or SSG render failure on development server.
- 8.4 /10 HighCVE-2026-106105
Quasar Framework - Information Disclosure
Quasar Framework prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0 contains an information disclosure vulnerability caused by improper filesystem permissions on cached private key and certificate PEM, letting local attackers impersonate development TLS endpoints, exploit requires local user access to cache files.
- 8.7 /10 HighCVE-2026-106104 No auth
Quasar Framework - Denial of Service
Quasar Framework < 2.23.3 contains a denial of service caused by unbounded User-Agent header parsing in Platform.parseSSR(), letting unauthenticated attackers block the Node.js event loop, exploit requires crafted repeated version tokens in User-Agent header.
- 7.1 /10 HighCVE-2026-106103 No auth
Quasar Framework @quasar/icongenie - Path Traversal
Quasar Framework @quasar/icongenie < 6.1.1 contains a path traversal caused by insufficient validation of folder and name values in user-supplied profiles, letting developers overwrite arbitrary writable files, exploit requires running crafted profile.
- 7.1 /10 HighCVE-2026-106100 Auth required
Payload @payloadcms/db-mongodb - Broken Access Control
Payload @payloadcms/db-mongodb < 3.87.0 and < 4.0.0-canary.20 contains a broken access control vulnerability caused by improper enforcement of field-level write permissions, letting authenticated users modify restricted fields, exploit requires authenticated user with document update permissions.
- 7.8 /10 HighCVE-2026-106062 No auth
GIMP - Buffer Overflow
GIMP contains a heap-based buffer overflow caused by integer overflow in size calculations in the DirectDraw Surface (DDS) loader, letting attackers execute arbitrary code via crafted DDS images, exploit requires crafted image input.
- 8.2 /10 HighCVE-2026-106040
Mooncake Store - Broken Access Control
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability in EvictDiskReplica and BatchEvictDiskReplica, letting unauthenticated attackers erase disk replicas across tenants, exploit requires access to coro_rpc master port.