Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 717 of 767

  • 8.3 /10 High
    CVE-2026-87480

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Printing, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.3 /10 High
    CVE-2026-87479 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains an insufficient policy enforcement vulnerability in Extensions, caused by improper sandboxing, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-87474 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Payments, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 8.1 /10 High
    CVE-2026-87471 No auth

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in ServiceWorker, letting remote attackers who compromised the renderer process bypass site isolation via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-87470 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Mac < 153.0.8010.36 contains a remote code execution caused by improper quantity validation in Tint, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-87467 No auth

    Google Chrome - Race Condition

    Google Chrome on Windows < 153.0.8010.36 contains a race condition in Updater, letting local attackers execute arbitrary code outside the sandbox via a local program, exploit requires local access.

  • 9.6 /10 Critical
    CVE-2026-87464 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 8.8 /10 High
    CVE-2026-87460 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Platform component, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-87457 No auth

    Google Chrome - Race Condition

    Google Chrome on Windows < 153.0.8010.36 contains a race condition in Updater, letting local attackers execute arbitrary code outside the sandbox via a local program, exploit requires local access.

  • 9.6 /10 Critical
    CVE-2026-87455 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Aura, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 7.5 /10 High
    CVE-2026-87450 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains a broken access control vulnerability caused by incorrect authorization in Permissions, letting remote attackers obtain sensitive information via crafted extensions, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-87448 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in DevTools, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 8.8 /10 High
    CVE-2026-87444 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by memory corruption in codecs, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.8 /10 High
    CVE-2026-87440 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains an out of bounds read in Media component, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87438 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 153.0.8010.36 contains an out of bounds write in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.