IT SBIT Services
Schneeberger
DEEN
CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.

255published today
3,439in the last 7 days
16,514in the last 30 days
258critical (7 days)
9newly exploited (7 days)
299with a public exploit (30 days)

New CVEs in the last 30 days by severity

  • Critical
  • High
  • Medium
  • Low
  • Not rated
01,0002,0003,000Sun, 4 Oct 2026: 68 CVE (Critical 13, High 16, Medium 28, Low 11)4 OctMon, 5 Oct 2026: 405 CVE (Critical 31, High 119, Medium 210, Low 45)Tue, 6 Oct 2026: 1,014 CVE (Critical 105, High 371, Medium 345, Low 38, Not rated 155)Wed, 7 Oct 2026: 340 CVE (Critical 53, High 131, Medium 145, Low 9, Not rated 2)Thu, 8 Oct 2026: 497 CVE (Critical 62, High 194, Medium 220, Low 21)Fri, 9 Oct 2026: 315 CVE (Critical 42, High 152, Medium 105, Low 11, Not rated 5)9 OctSat, 10 Oct 2026: 412 CVE (Critical 78, High 143, Medium 178, Low 13)Sun, 11 Oct 2026: 229 CVE (Critical 16, High 73, Medium 101, Low 39)Mon, 12 Oct 2026: 674 CVE (Critical 48, High 264, Medium 282, Low 80)Tue, 13 Oct 2026: 2,303 CVE (Critical 170, High 1,361, Medium 729, Low 43)Wed, 14 Oct 2026: 824 CVE (Critical 92, High 374, Medium 285, Low 30, Not rated 43)14 OctThu, 15 Oct 2026: 546 CVE (Critical 51, High 232, Medium 244, Low 19)Fri, 16 Oct 2026: 465 CVE (Critical 53, High 179, Medium 219, Low 14)Sat, 17 Oct 2026: 100 CVE (Critical 4, High 42, Medium 50, Low 4)Sun, 18 Oct 2026: 549 CVE (Critical 10, High 55, Medium 65, Low 19, Not rated 400)Mon, 19 Oct 2026: 437 CVE (Critical 29, High 128, Medium 204, Low 66, Not rated 10)19 OctTue, 20 Oct 2026: 1,923 CVE (Critical 169, High 813, Medium 812, Low 127, Not rated 2)Wed, 21 Oct 2026: 542 CVE (Critical 50, High 218, Medium 225, Low 47, Not rated 2)Thu, 22 Oct 2026: 492 CVE (Critical 69, High 160, Medium 206, Low 55, Not rated 2)Fri, 23 Oct 2026: 492 CVE (Critical 40, High 170, Medium 91, Low 27, Not rated 164)Sat, 24 Oct 2026: 73 CVE (Critical 12, High 20, Medium 35, Low 6)24 OctSun, 25 Oct 2026: 131 CVE (Critical 3, High 33, Medium 66, Low 26, Not rated 3)Mon, 26 Oct 2026: 738 CVE (Critical 21, High 135, Medium 249, Low 56, Not rated 277)Tue, 27 Oct 2026: 648 CVE (Critical 69, High 188, Medium 177, Low 33, Not rated 181)Wed, 28 Oct 2026: 626 CVE (Critical 35, High 223, Medium 214, Low 31, Not rated 123)Thu, 29 Oct 2026: 537 CVE (Critical 66, High 195, Medium 219, Low 22, Not rated 35)29 OctFri, 30 Oct 2026: 669 CVE (Critical 45, High 218, Medium 260, Low 30, Not rated 116)Sat, 31 Oct 2026: 112 CVE (Critical 11, High 44, Medium 51, Low 1, Not rated 5)Sun, 1 Nov 2026: 98 CVE (Critical 8, High 24, Medium 27, Low 15, Not rated 24)Mon, 2 Nov 2026: 255 CVE (Critical 17, High 76, Medium 110, Low 14, Not rated 38)2 Nov

Per day (UTC); hover over a bar for the figures.

Show as table
DayCriticalHighMediumLowNot ratedTotal
Mon, 2 Nov 202617761101438255
Sun, 1 Nov 202682427152498
Sat, 31 Oct 202611445115112
Fri, 30 Oct 20264521826030116669
Thu, 29 Oct 2026661952192235537
Wed, 28 Oct 20263522321431123626
Tue, 27 Oct 20266918817733181648
Mon, 26 Oct 20262113524956277738
Sun, 25 Oct 202633366263131
Sat, 24 Oct 20261220356073
Fri, 23 Oct 2026401709127164492
Thu, 22 Oct 202669160206552492
Wed, 21 Oct 202650218225472542
Tue, 20 Oct 202616981381212721,923
Mon, 19 Oct 2026291282046610437
Sun, 18 Oct 202610556519400549
Sat, 17 Oct 20264425040100
Fri, 16 Oct 202653179219140465
Thu, 15 Oct 202651232244190546
Wed, 14 Oct 2026923742853043824
Tue, 13 Oct 20261701,3617294302,303
Mon, 12 Oct 202648264282800674
Sun, 11 Oct 20261673101390229
Sat, 10 Oct 202678143178130412
Fri, 9 Oct 202642152105115315
Thu, 8 Oct 202662194220210497
Wed, 7 Oct 20265313114592340
Tue, 6 Oct 2026105371345381551,014
Mon, 5 Oct 202631119210450405
Sun, 4 Oct 202613162811068

767 vulnerabilities · Vendor: Google

CVE-2026-106228High 8.3

Google Chrome: Confused deputy in Google Lens enables sandbox escape

Google Chrome before 155.0.8059.39 contains a confused deputy flaw (CWE-441) in the Google Lens component. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires a separate renderer compromise and user interaction, so the flaw is a second stage in an attack chain.

Google · Chrome

CVE-2026-106227Critical 9.6

Google Chrome: Use-after-free in Core allows remote code execution

A use-after-free flaw in the Core component of Google Chrome desktop allows a remote attacker to execute arbitrary code outside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, so no login or prior access is required. The CVSS 3.1 base score is 9.6 (Critical) and Chromium rates the issue High.

Google · Chrome

CVE-2026-106221High 8.3

Google Chrome for Android: Confused deputy in WebAPKs allows origin policy bypass

A confused deputy flaw in WebAPKs, the Android app packages that Chrome generates for installed web apps, allows a remote attacker to bypass the web origin policy. The attack requires a user to open a crafted HTML page, and the attacker relies on social engineering to get the user there. CISA SSVC rates the technical impact as total, but exploitation is not automatable and no exploitation has been observed.

Google · Chrome for Android

CVE-2026-106220High 8.8

Google Chrome: Information leak in Passwords component

Google Chrome desktop versions before 155.0.8059.39 contain an information leak in the built-in Passwords component (CWE-200). A remote attacker can obtain sensitive information by luring a user to a crafted HTML page, so the victim only needs to open the page in an affected browser. The NVD rates it CVSS 8.8, but Chromium rates it Low and the impact described is information disclosure, so the score should be treated with caution. Password exposure is the main business risk.

Google · Chrome

CVE-2026-106212High 8.8

Google Chrome: Incorrect authorization in Autofill allows data disclosure

Google Chrome versions before 155.0.8059.39 contain an incorrect authorization flaw in the Autofill component. A remote attacker who uses social engineering can obtain sensitive information by luring a user to a crafted HTML page. The victim must open the page, but no privileges are required. Google rates the issue Medium severity internally.

Google · Chrome

CVE-2026-106211Critical 9.6

Google Chrome: Use-after-free in TabStrip allows code execution

A use-after-free flaw in the TabStrip tab bar component of Google Chrome desktop can be exploited by a remote attacker who uses social engineering to get the user to open a crafted HTML page. Successful exploitation could allow arbitrary code execution outside the browser sandbox, with high impact on confidentiality, integrity and availability. Google rates the Chromium security severity as High, and the CVSS base score is 9.6 (critical).

Google · Chrome

CVE-2026-106207High 8.8

Google Chrome: Race condition in V8 allows code execution in sandbox

A race condition in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute code inside the browser sandbox. Affected are Chrome versions before 155.0.8059.39 on Linux and before 155.0.8059.39/.40 on Windows and macOS. The attacker only needs to lure a user to a crafted HTML page, and no authentication is required. NVD rates the issue CVSS 8.8 (High), while Chromium rates it Medium; the impact is limited to the sandbox unless it is chained with a second flaw.

Google · Chrome

CVE-2026-106205High 8.1

Google Chrome: Missing authorization in Passwords allows site isolation bypass

Missing authorization in the Passwords component of Google Chrome on Android allows a remote attacker to bypass site isolation. The attacker must first have compromised the renderer process and then lure the user to a crafted HTML page. The flaw is a second-stage weakness in an exploit chain, and the confidentiality and integrity of data stored in the browser are at risk.

Google · Chrome

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed