Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 625 of 677

  • 9.6 /10 Critical
    CVE-2026-87528 PoC publicNo auth

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 153.0.8010.36 contains a type confusion vulnerability in Rust, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87527 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87526 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Passwords component, letting remote attackers execute arbitrary code outside the sandbox via UI interaction, exploit requires user interaction.

  • 8.3 /10 High
    CVE-2026-87524 No auth

    Google Chrome - Use After Free

    Google Chrome on Windows < 153.0.8010.36 contains a use after free vulnerability in Core, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 9.6 /10 Critical
    CVE-2026-87520 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 153.0.8010.36 contains a use after free caused by improper memory handling in Dawn, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.1 /10 High
    CVE-2026-87514 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Views, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 9.6 /10 Critical
    CVE-2026-87512 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 on Windows contains a use after free vulnerability in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-87510 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by improper input validation in FileAPI, letting remote attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-87509 No auth

    Google Chrome - Authorization Bypass

    Google Chrome on Windows < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in Updater, letting local attackers execute arbitrary code outside the sandbox via a local program, exploit requires local access.

  • 8.3 /10 High
    CVE-2026-87506

    Google Chrome - Privilege Escalation

    Google Chrome < 153.0.8010.36 contains a privilege escalation caused by a vulnerability in WebUI, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.1 /10 High
    CVE-2026-87505 PoC publicNo auth

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in FileSystem, letting remote attackers who compromised the renderer process bypass site isolation via crafted PDF files, exploit requires compromised renderer process.

  • 9.6 /10 Critical
    CVE-2026-87504 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Core, letting remote attackers execute arbitrary code outside the sandbox via crafted Chrome extensions, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-87500 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by improper validation of array index in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-87499

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in the Network component, letting remote attackers who compromised the renderer process bypass site isolation via crafted HTML, exploit requires compromised renderer process.

  • 9.6 /10 Critical
    CVE-2026-87494 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 on Windows contains a use after free vulnerability caused by improper memory handling in the browser, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.