High CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

High CVEs

Newest first · severity as published by the vendor or NVD · page 678 of 725

  • 8.3 /10 High
    CVE-2026-87572

    Google Chrome - Code Injection

    Google Chrome < 153.0.8010.36 contains a code injection vulnerability in DevTools caused by improper input handling, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.8 /10 High
    CVE-2026-87570 No auth

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in SiteIsolation, letting remote attackers who compromised the renderer process bypass site isolation via crafted files, exploit requires social engineering.

  • 8.8 /10 High
    CVE-2026-87569 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 153.0.8010.36 contains a broken access control caused by missing authorization in Views, letting remote attackers bypass system access restrictions via crafted HTML pages using social engineering.

  • 8.1 /10 High
    CVE-2026-87554 No auth

    Google Chrome - Race Condition

    Google Chrome < 153.0.8010.36 contains a race condition in Chromoting, letting local attackers execute arbitrary code outside the sandbox via a local program, exploit requires local access.

  • 8.3 /10 High
    CVE-2026-87553 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by improper input validation in SiteIsolation, letting remote attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 8.8 /10 High
    CVE-2026-87542 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Input, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.1 /10 High
    CVE-2026-87537 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by missing authorization in Extensions, letting remote attackers with compromised renderer process execute arbitrary code outside the sandbox via crafted network traffic.

  • 8.8 /10 High
    CVE-2026-87536 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in V8, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 8.1 /10 High
    CVE-2026-87533 PoC publicNo auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in DevTools, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 8.1 /10 High
    CVE-2026-87530 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 153.0.8010.36 contains an uncontrolled search path element vulnerability in CredentialProvider, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 8.3 /10 High
    CVE-2026-87524 No auth

    Google Chrome - Use After Free

    Google Chrome on Windows < 153.0.8010.36 contains a use after free vulnerability in Core, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.

  • 8.1 /10 High
    CVE-2026-87514 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Views, letting local attackers execute arbitrary code outside the sandbox via a local program.

  • 8.3 /10 High
    CVE-2026-87510 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by improper input validation in FileAPI, letting remote attackers with compromised renderer process execute arbitrary code outside sandbox via crafted HTML page.

  • 8.1 /10 High
    CVE-2026-87509 No auth

    Google Chrome - Authorization Bypass

    Google Chrome on Windows < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in Updater, letting local attackers execute arbitrary code outside the sandbox via a local program, exploit requires local access.

  • 8.3 /10 High
    CVE-2026-87506

    Google Chrome - Privilege Escalation

    Google Chrome < 153.0.8010.36 contains a privilege escalation caused by a vulnerability in WebUI, letting remote attackers who compromised the renderer process execute arbitrary code outside the sandbox via crafted HTML, exploit requires compromised renderer process.