High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
11502
Critical
2091
CISA KEV
92
Public PoC
393

Most common types

  • Broken Access Control 1499
  • Remote Code Execution 1456
  • Privilege Escalation 1227
  • Authentication Bypass 940
  • Denial of Service 799

Published per day, last 14 days

8 Oct Critical Other 21 Oct

Source: public CVE records (NVD, CISA KEV) · last published 21 Oct 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 579 of 628

  • 7.5 /10 High
    CVE-2026-87734 No auth

    utcp - Denial of Service

    utcp < 0.0.6 for OCaml contains a denial of service caused by out-of-order segment reassembly, letting remote attackers cause service disruption, exploit requires network access.

  • 8.3 /10 High
    CVE-2026-87648

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 on Windows contains a use after free vulnerability in ANGLE, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.3 /10 High
    CVE-2026-87644 No auth

    Google Chrome - Authorization Bypass

    Google Chrome on Windows < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in Views, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML page, exploit requires social engineering.

  • 8.3 /10 High
    CVE-2026-87639 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in WebPackaging, letting attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 8.8 /10 High
    CVE-2026-87636 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a type confusion vulnerability in XML processing, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires victim to load malicious page.

  • 8.6 /10 High
    CVE-2026-87633 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Views, letting local attackers execute arbitrary code outside the sandbox via UI interaction.

  • 8.3 /10 High
    CVE-2026-87628 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Cast, letting adjacent attackers execute arbitrary code outside the sandbox via crafted network traffic.

  • 8.8 /10 High
    CVE-2026-87625 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted Chrome extensions, exploit requires user interaction.

  • 8.3 /10 High
    CVE-2026-87618

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 153.0.8010.36 contains a remote code execution caused by incorrect reference resolution in Storage, letting attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 8.8 /10 High
    CVE-2026-87617 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in DevTools, caused by improper memory handling, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 8.3 /10 High
    CVE-2026-87616

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 153.0.8010.36 contains an improper initialization vulnerability in Views, letting remote attackers who compromised the renderer process and used social engineering execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process and social engineering.

  • 8.8 /10 High
    CVE-2026-87612 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a type confusion vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via a crafted HTML page, exploit requires victim to visit malicious page.

  • 7.5 /10 High
    CVE-2026-87608 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains an insecure certificate validation vulnerability in FedCM, letting remote attackers bypass web origin policy via crafted network traffic and social engineering.

  • 8.1 /10 High
    CVE-2026-87606 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains a broken access control caused by missing authorization in SiteIsolation, letting remote attackers who compromised the renderer process bypass site isolation via crafted HTML page.

  • 8.3 /10 High
    CVE-2026-87604

    Google Chrome - Out of Bounds Read

    Google Chrome < 153.0.8010.36 contains an out of bounds read caused by improper memory handling in ANGLE, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.