Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Mon, 2 Nov 2026 | 9 | 11 | 31 | 12 | 56 | 119 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
767 vulnerabilities · Vendor: Google
A use-after-free flaw in the WebRTC component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a user to visit a crafted HTML page. Google rates the issue as High severity, and the NVD base score is 8.8.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome before 155.0.8059.39 contains an incorrect authorization flaw in the WebProtect component (CWE-863). A remote attacker using social engineering can get a user to open a crafted HTML page and obtain sensitive information. The attack requires the user to load the page and interact with it, but no account is needed. Google rates the issue Medium in Chromium; NVD scores it 8.8 (CVSS 3.1), which is likely conservative for the expected confidentiality impact.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 155.0.8059.39 contain an incorrect authorization flaw in the Browser component. A remote attacker can obtain sensitive information if a user opens a crafted HTML page. No attacker privileges are required, but user interaction is. Chromium rates the issue as Low severity, while NVD scores it 8.8 (High).
Google · Chrome
A use-after-free vulnerability in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user visits a crafted HTML page, for example through a link in a phishing email or a malicious website. Code execution inside the sandbox alone does not give full control of the system; a separate sandbox escape would be needed.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 155.0.8059.39 contain a use-after-free vulnerability in the component named Track. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user opens the page, for example during ordinary web browsing. The Chromium security severity is rated Critical, but no sandbox escape has been reported.
Google · Chrome
Improper state validation in the DevTools component of Google Chrome before 155.0.8059.39 can be triggered by a crafted HTML page. A remote attacker could potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, and the NVD record gives no further exploit details.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome versions before 155.0.8059.39 contain an information leak in the Autofill feature. A remote attacker can obtain sensitive information by luring a user to a crafted HTML page. The vendor rates the issue Medium, and the NVD CVSS 3.1 base score is 8.8 (High), with the attack requiring user interaction.
Google · Chrome
Google Chrome before 155.0.8059.39 contains a type confusion flaw in the V8 JavaScript engine. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user opens the malicious page. Google rates the Chromium security severity as Medium, and CISA SSVC lists no exploitation.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free vulnerability in the Media component of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open a crafted HTML page. Google rates the issue as Medium severity in its own scale, and CISA SSVC assessment reports no exploitation.
Google · Chrome
A flaw in the Payments component of Google Chrome before 155.0.8059.39 can expose sensitive information. A remote attacker must socially engineer a user into opening a crafted HTML page, and no login is required. Chromium rates the issue as Low, while the NVD CVSS score is 8.8, so the actual impact should be verified.
Google · Chrome
Research and translation in progress – available shortly.
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
