Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10203
Critical
1875
CISA KEV
79
Public PoC
367

Most common types

  • Broken Access Control 1267
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

5 Oct Critical Other 18 Oct

Source: public CVE records (NVD, CISA KEV) · last published 18 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 501 of 681

  • 8.3 /10 High
    CVE-2026-91751 Auth required

    Flextype CMS - Path Traversal

    Flextype CMS through 1.0.0-alpha.3 contains a path traversal caused by improper validation of id and new_id parameters in the Entries REST API, letting API token holders read, create, or overwrite arbitrary files outside the entries directory, exploit requires API token.

  • 9.6 /10 Critical
    CVE-2026-91749 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in Workers, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-91748 No auth

    Google Chrome - Race Condition

    Google Chrome on Mac < 153.0.8010.47 contains a race condition in Extensions, letting remote attackers who compromised the renderer process and used social engineering execute arbitrary code outside the sandbox via UI interaction.

  • 8.8 /10 High
    CVE-2026-91745 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-91743

    Google Chrome - Race Condition

    Google Chrome < 153.0.8010.47 contains a race condition in Core, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-91741 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.47 contains a remote code execution caused by type confusion in CacheStorage, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires victim to load crafted page.

  • 9.6 /10 Critical
    CVE-2026-91738 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.47 contains a remote code execution caused by improper input validation in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-91737 PoC publicNo auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in PDF component, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-91736 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in DOM, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-91735

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.47 contains an authorization bypass caused by incorrect authorization in WebUI, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page.

  • 7.4 /10 High
    CVE-2026-91734 No auth

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.47 contains an authorization bypass caused by incorrect authorization in Core, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 8.3 /10 High
    CVE-2026-91733 No auth

    Google Chrome - Information Disclosure

    Google Chrome < 153.0.8010.47 contains an information disclosure vulnerability caused by improper state validation in Skia, letting remote attackers with compromised renderer process read memory outside the sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-91732 PoC public

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.47 contains a broken access control caused by missing authorization in AppManifest, letting remote attackers who compromised the renderer process bypass web origin policy via crafted HTML page, exploit requires renderer compromise and social engineering.

  • 8.8 /10 High
    CVE-2026-91731 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.47 contains a remote code execution caused by type confusion in Compositing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-91729 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in DigitalCredentials, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.