Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Mon, 2 Nov 2026 | 26 | 104 | 138 | 16 | 165 | 449 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 45 | 218 | 261 | 30 | 115 | 669 |
| Thu, 29 Oct 2026 | 69 | 198 | 221 | 22 | 27 | 537 |
| Wed, 28 Oct 2026 | 35 | 223 | 214 | 31 | 123 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 157 | 266 | 57 | 237 | 738 |
| Sun, 25 Oct 2026 | 4 | 35 | 66 | 26 | 0 | 131 |
| Sat, 24 Oct 2026 | 12 | 20 | 35 | 6 | 0 | 73 |
| Fri, 23 Oct 2026 | 40 | 170 | 91 | 27 | 164 | 492 |
| Thu, 22 Oct 2026 | 69 | 161 | 208 | 54 | 0 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 814 | 812 | 127 | 1 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
768 vulnerabilities · Vendor: Google
A confused deputy flaw in the Android Settings component allows a permission bypass. A local attacker or malicious app can use it to escalate privileges on the device without additional execution privileges and without user interaction. The CVSS vector rates confidentiality, integrity and availability impact as High.
Google · Android
A logic error in the device admin apps settings component (DeviceAdminAppsPreferenceController, updateState) of Android allows a permission bypass. A local attacker with low privileges, for example a malicious app already running on the device, can escalate privileges to a higher level. No user interaction is required, and no additional execution privileges are needed.
Google · Android
A logic error in the Settings controller ApplicationActionButtonsPreferenceController on Android Automotive OS allows a permission bypass. A local attacker with an existing low-privileged account, app or foothold could escalate privileges on the device. No user interaction is required, and according to Google the rating assumes platform mitigations are disabled or bypassed.
Google · Android
A permission bypass caused by improper input validation in CredentialStorageActivity.java allows a local attacker to escalate privileges on affected Android Automotive OS devices. Exploitation requires no additional execution privileges and no user interaction, but the attacker needs code running on the device, for example a malicious app. The vulnerability is rated High with a CVSS 3.1 score of 7.8.
Google · Android Automotive OS
A logic error in several locations of the Android system component allows a permission bypass. A local attacker with low privileges, for example a malicious installed app, can escalate privileges to a higher level. No user interaction is required, and the vulnerability is not remotely exploitable from the internet.
Google · Android
Google Chrome before 154.0.8037.97 contains a buffer overflow (CWE-122) in the WebRTC component, which handles real-time audio, video and peer-to-peer connections. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, and no privileges are needed. The NVD base score is 8.8 (High).
Google · Chrome
A use-after-free vulnerability in the FedCM (Federated Credential Management) feature of Google Chrome desktop allows a remote attacker to execute arbitrary code outside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, and the user must interact with it. Google rates the issue as High severity; CVSS 3.1 is 9.6 (Critical).
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome desktop versions before 154.0.8037.97 contain an out-of-bounds write in the WebGL component (CVE-2026-103628, CWE-787, CVSS 9.6 Critical). A remote attacker can run arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the victim must open the page.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome on Windows contains an incorrect authorization flaw in the FileSystem component (CWE-863). A remote attacker who lures a user to a crafted HTML page may be able to execute arbitrary code outside the browser sandbox. The attack requires user interaction, typically by social engineering or phishing.
Google · Chrome
Chrome versions before 154.0.8037.97 contain a type confusion flaw in the V8 JavaScript engine (CVE-2026-103625, CVSS 8.8). An attacker can run arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires the user to visit that page, and the sandbox is still needed for full compromise.
Google · Chrome
Google Chrome on Windows contains a use-after-free vulnerability (CWE-416) in the Contextual Tasks feature. An attacker who has already compromised the renderer process can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack requires a user to visit the page, so it is a second-stage risk that must be chained with a renderer vulnerability.
Google · Chrome
A use-after-free flaw (CWE-416) in the MediaStream component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, for example via a link in email or an advertisement. Escaping the sandbox to take full control of the system would require a separate exploit, which the sources do not cover.
Google · Chrome
A use-after-free flaw (CWE-416) in the SVG handling of Google Chrome before 154.0.8037.97 lets a remote attacker execute arbitrary code inside the browser sandbox. The attack requires only that a user loads a crafted HTML page, for example through a phishing link or a compromised website. Full system compromise would normally need a further sandbox escape, which the sources do not confirm.
Google · Chrome
Research and translation in progress – available shortly.
An out-of-bounds write in the V8 JavaScript and WebAssembly engine of Google Chrome before 153.0.8010.36 can be triggered by a crafted HTML page. A remote attacker can use it to execute arbitrary code inside the browser sandbox. The victim must visit the crafted page, and Google has confirmed that an exploit exists in the wild.
Google · Chrome
An integer overflow in the Android Framework, present in multiple locations, can allow an attacker to execute code and escalate privileges locally. The attacker needs no additional execution privileges and no user interaction, but needs a foothold on the device, typically through a malicious app. Google reports indications of limited, targeted exploitation, and CISA lists the flaw as known exploited.
Google · Android
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
