Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 324 of 767

  • 9.6 /10 Critical
    CVE-2026-106419 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 155.0.8059.39 contains a use after free vulnerability in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106417 No auth

    Google Chrome - Integer Overflow

    Google Chrome < 155.0.8059.39 contains an integer overflow in Media component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106414 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on iOS < 155.0.8059.39 contains a remote code execution vulnerability caused by improper input validation in Mobile component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires social engineering.

  • 8.3 /10 High
    CVE-2026-106412

    Google Chrome - Race Condition

    Google Chrome < 155.0.8059.39 contains a race condition in Core, letting remote attackers who compromised the renderer process and used social engineering execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process and social engineering.

  • 8.8 /10 High
    CVE-2026-106411 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability in the Parser, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-106409 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains a remote code execution caused by incorrect reference resolution in WebAppInstalls, letting attackers with compromised renderer process execute code outside sandbox via crafted network traffic.

  • 8.1 /10 High
    CVE-2026-106403

    Google Chrome - Authorization Bypass

    Google Chrome < 155.0.8059.39 contains an authorization bypass caused by incorrect authorization in Accessibility, letting remote attackers who compromised the renderer process bypass site isolation via crafted HTML, exploit requires compromised renderer process.

  • 9.6 /10 Critical
    CVE-2026-106401 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains an out of bounds write vulnerability in Media, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-106393

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability caused by improper memory handling in Storage, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-106387 No auth

    Google Chrome - Broken Access Control

    Google Chrome on iOS < 155.0.8059.39 contains a broken access control caused by missing authorization in Mobile, letting remote attackers obtain sensitive information via crafted HTML pages, exploit requires social engineering.

  • 8.8 /10 High
    CVE-2026-106383 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free vulnerability in Media, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-106382 No auth

    Google Chrome - Use After Free

    Google Chrome < 155.0.8059.39 contains a use after free caused by improper memory handling in Chromecast component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-106378

    Google Chrome - Privilege Escalation

    Google Chrome < 155.0.8059.39 contains a privilege escalation caused by sandbox escape via crafted HTML page in the renderer process, letting remote attackers execute arbitrary code outside the sandbox, exploit requires compromised renderer process.

  • 8.3 /10 High
    CVE-2026-106377

    Google Chrome - Race Condition

    Google Chrome < 155.0.8059.39 contains a race condition in Fonts, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires renderer process compromise.

  • 9.6 /10 Critical
    CVE-2026-106375 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 155.0.8059.39 contains a remote code execution caused by incomplete cleanup in Dawn component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.