Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 623 of 677

  • 8.8 /10 High
    CVE-2026-87612 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a type confusion vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via a crafted HTML page, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-87609 No auth

    Google Chrome - Use After Free

    Google Chrome on iOS < 153.0.8010.36 contains a use after free vulnerability in Sharing, letting remote attackers execute arbitrary code outside the sandbox via crafted network traffic.

  • 7.5 /10 High
    CVE-2026-87608 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains an insecure certificate validation vulnerability in FedCM, letting remote attackers bypass web origin policy via crafted network traffic and social engineering.

  • 9.6 /10 Critical
    CVE-2026-87607 No auth

    Google Chrome - Use After Free

    Google Chrome on Mac < 153.0.8010.36 contains a use after free vulnerability in Device, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 8.1 /10 High
    CVE-2026-87606 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains a broken access control caused by missing authorization in SiteIsolation, letting remote attackers who compromised the renderer process bypass site isolation via crafted HTML page.

  • 8.3 /10 High
    CVE-2026-87604

    Google Chrome - Out of Bounds Read

    Google Chrome < 153.0.8010.36 contains an out of bounds read caused by improper memory handling in ANGLE, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 7.5 /10 High
    CVE-2026-87601 No auth

    Google Chrome - Race Condition

    Google Chrome < 153.0.8010.36 contains a race condition in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-87595 No auth

    Google Chrome - Server Side Request Forgery

    Google Chrome < 153.0.8010.36 contains a server side request forgery caused by crafted HTML page, letting remote attackers bypass system access restrictions via social engineering.

  • 8.8 /10 High
    CVE-2026-87588 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Chromecast, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-87587 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in V8, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-87585 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a double free vulnerability in PDFium, letting remote attackers execute arbitrary code inside the sandbox via crafted PDF files, exploit requires crafted PDF file.

  • 8.3 /10 High
    CVE-2026-87582 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by confused deputy issue in DataTransfer, letting remote attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-87581 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Payments, caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 8.8 /10 High
    CVE-2026-87579 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in WebRTC caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-87578 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Receiver, letting adjacent attackers execute arbitrary code outside the sandbox via crafted network traffic.