Threat Heartbeat

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Latest CVEs

Newest first · severity as published by the vendor or NVD · page 836 of 891

  • 8.4 /10 High
    CVE-2026-87794 No auth

    bestzip - Command Injection

    bestzip 2.2.6 and 3.0.2 contain a command injection caused by argument injection in the nativeZip function, letting attackers execute arbitrary commands with Node.js process privileges, exploit requires crafted source entries and malicious destination path.

  • 8.8 /10 High
    CVE-2026-87766 Auth required

    bubblewrap - Path Traversal

    bubblewrap before 0.12.0 contains a path traversal caused by following parent symlinks via /oldroot during sandbox setup, letting attackers write files outside the sandbox as the launching user, exploit requires sandbox setup.

  • 7.5 /10 High
    CVE-2026-87734 No auth

    utcp - Denial of Service

    utcp < 0.0.6 for OCaml contains a denial of service caused by out-of-order segment reassembly, letting remote attackers cause service disruption, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-87654 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in ANGLE on Windows, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87650 No auth

    Google Chrome - Out of Bounds Read

    Google Chrome < 153.0.8010.36 contains an out of bounds read in WebGL, letting remote attackers potentially execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 8.3 /10 High
    CVE-2026-87648

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 on Windows contains a use after free vulnerability in ANGLE, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 9.6 /10 Critical
    CVE-2026-87646 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Web Authentication, caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 8.3 /10 High
    CVE-2026-87644 No auth

    Google Chrome - Authorization Bypass

    Google Chrome on Windows < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in Views, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-87643 No auth

    Google Chrome - Integer Overflow

    Google Chrome on Android < 153.0.8010.36 contains an integer overflow in GPU, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires victim to visit malicious page.

  • 8.3 /10 High
    CVE-2026-87639 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in WebPackaging, letting attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-87638 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains an out of bounds write in Media component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87637 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Extensions, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 8.8 /10 High
    CVE-2026-87636 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a type confusion vulnerability in XML processing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires victim to load malicious page.

  • 9.6 /10 Critical
    CVE-2026-87634 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in WebPackaging, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 8.6 /10 High
    CVE-2026-87633 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Views, letting local attackers execute arbitrary code outside the sandbox via UI interaction.