Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10425
Critical
1916
CISA KEV
79
Public PoC
384

Most common types

  • Broken Access Control 1290
  • Privilege Escalation 1190
  • Remote Code Execution 1111
  • Authentication Bypass 835
  • Denial of Service 799

Published per day, last 14 days

7 Oct Critical Other 20 Oct

Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 455 of 695

  • 8.8 /10 High
    CVE-2026-93377 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.52 contains a type confusion vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 8.1 /10 High
    CVE-2026-93375 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 153.0.8010.52 contains a local code execution vulnerability caused by incorrect reference resolution in Tracing, letting local attackers execute arbitrary code outside the sandbox, exploit requires local access.

  • 9.6 /10 Critical
    CVE-2026-93374 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 153.0.8010.52 contains a use after free vulnerability in Dawn, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-93373 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.52 contains a use after free vulnerability in Extensions, letting remote attackers execute arbitrary code outside the sandbox via crafted extensions.

  • 9.6 /10 Critical
    CVE-2026-93372 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 153.0.8010.52 contains a buffer overflow in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 7.8 /10 High
    CVE-2026-93337 Auth required

    NetworkManager-l2tp - Command Injection

    NetworkManager-l2tp contains an improper input validation vulnerability caused by unvalidated mru or mtu property values in pppd options, letting local users with VPN creation permissions execute arbitrary code as root, exploit requires VPN connection creation permissions.

  • 8.5 /10 High
    CVE-2026-93292 Auth required

    SigNoz - SQL Injection

    SigNoz 0.88.0 before 0.142.1 contains a sql injection caused by unescaped interpolation of service_name and span_name fields in trace-funnel analytics endpoints, letting authenticated attackers execute arbitrary SQL queries and read results.

  • 7.1 /10 High
    CVE-2026-93203 No auth

    Linux kernel batman-adv - Data Tampering

    Linux kernel batman-adv contains a CRC corruption vulnerability caused by parallel claim add operations in batadv_bla_add_claim(), letting attackers cause incorrect CRC calculations in backbone claims, exploit requires concurrent claim processing.

  • 7.8 /10 High
    CVE-2026-93201 Auth required

    Linux Kernel dm-pcache - Out-of-Bounds Read & Write

    Linux kernel dm-pcache contains an out-of-bounds read and write vulnerability caused by lack of validation of seg_id fields from persistent memory in cache device metadata, letting attackers with CAP_SYS_ADMIN privileges cause memory corruption, exploit requires CAP_SYS_ADMIN privilege.

  • 8.4 /10 High
    CVE-2026-93196 No auth

    Linux Kernel - Use After Free

    Linux kernel contains a use-after-free vulnerability in virtio_pmem caused by improper refcounting of request tokens in virtio_pmem_host_ack, letting attackers cause kernel memory corruption, exploit requires kernel-level access.

  • 7.8 /10 High
    CVE-2026-93192 Auth required

    Linux Kernel drm/v3d - Use After Free

    Linux kernel drm/v3d contains a use-after-free vulnerability caused by not clearing queue->active_job when v3d_fence_create() fails in run_job() callbacks, letting attackers cause system instability or denial of service, exploit requires triggering fence creation failure.

  • 8.4 /10 High
    CVE-2026-93190

    Linux Kernel - Buffer Overflow

    Linux kernel contains a buffer overflow caused by lack of bounds checking on source_cap_count and sink_cap_count in cros_typec_register_partner_pdos(), letting attackers cause memory corruption by providing out-of-bounds PD cap counts, exploit requires malicious EC firmware or crafted response.

  • 8.8 /10 High
    CVE-2026-93189

    Linux Kernel HID - Use After Free

    Linux kernel contains a use-after-free vulnerability in HID subsystem caused by missing input quiescence in hid_hw_stop(), letting attackers cause memory corruption via in-flight HID reports during driver probe failure, exploit requires driver probe failure with in-flight HID reports.

  • 7.1 /10 High
    CVE-2026-93178

    Linux Kernel - Out of Bounds Read/Write

    Linux kernel contains a buffer bounds issue caused by lack of bounds check on voltage index in SMU7 lookup in drm/amdgpu/pm/powerplay, letting attackers cause denial of service or system instability, exploit requires crafted input from VBIOS-parsed tables.

  • 7.3 /10 High
    CVE-2026-93177 Auth required

    Linux kernel - Out of Bounds Read/Write

    Linux kernel contains a buffer overflow vulnerability caused by lack of bounds checking on voltage index in Vega10 lookup in drm/amdgpu/pm/powerplay, letting attackers cause denial of service or system instability, exploit requires local access.