Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 36 of 166

  • 9.6 /10 Critical
    CVE-2026-113342 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a memory corruption vulnerability in Network component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-113336 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a memory corruption vulnerability in Compositing, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-113328 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a remote code execution caused by improper input validation in Privacy component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-113300 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains an out of bounds write caused by improper handling in Forms, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-113283 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a memory corruption vulnerability in CredentialProvider, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-113270 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.47 contains a use after free caused by improper memory handling in internals, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-113263 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 156.0.8078.47 contains a use after free caused by improper memory handling in Core, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-113261 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.47 contains a use after free caused by improper memory handling in WebAppInstalls, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-113252 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 156.0.8078.47 contains a remote code execution caused by improper input validation in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special conditions.

  • 9.6 /10 Critical
    CVE-2026-113235 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a remote code execution caused by improper input validation in Passwords, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-113222 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.47 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-113211 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a memory corruption vulnerability in ServiceWorker, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-113189 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.47 contains a use after free caused by improper memory handling in Core, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-113186 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.47 contains a memory corruption vulnerability in DevTools caused by crafted HTML page, letting remote attackers execute arbitrary code outside the sandbox, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-113171 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 156.0.8078.47 contains a memory corruption vulnerability in Prompts, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.