Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 2 | 2 | 12 | 1 | 1 | 18 |
| Sat, 31 Oct 2026 | 11 | 41 | 44 | 0 | 16 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
3,473 vulnerabilities
Google Chrome versions before 156.0.8078.79 contain a memory corruption flaw (CWE-119) in the Network component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, for example via a phishing link or a compromised website.
Google · Chrome
Google Chrome prior to 156.0.8078.79 contains a use-after-free vulnerability in the FileSystem component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires user interaction, such as visiting the page, and the impact is limited to the sandbox unless it is chained with a sandbox escape.
Google · Chrome
Research and translation in progress – available shortly.
Memory corruption in the Autofill feature of Google Chrome before 156.0.8078.79 can be abused by a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user visits a crafted HTML page, for example through a phishing link or a compromised website. Chromium rates the flaw as High severity, and CVSS 3.1 is 8.8.
Google · Chrome
Google Chrome before 156.0.8078.79 contains a use-after-free flaw in its FileSystem component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The vendor rates the issue High; no user interaction beyond visiting the page is needed, and no authentication is required.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free flaw in Skia, the graphics library used for rendering in Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits a crafted HTML page, for example via phishing or a compromised website. The CVSS base score is 8.8 (High).
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain an improper input validation flaw in the CacheStorage component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the victim must open the page.
Google · Chrome
A use-after-free flaw in the Blink rendering engine of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page (user interaction required) and no prior privileges. Exploitation of the sandbox alone does not give full system control, and the sources describe no sandbox escape.
Google · Chrome
Google Chrome before 156.0.8078.79 contains an integer overflow (CWE-190) in its Editing component, which handles rich-text editing. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, but no login is required. Full compromise would normally need a further sandbox escape, which the sources do not describe.
Google · Chrome
Google Chrome before 156.0.8078.79 contains a memory corruption flaw in its DOM handling. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, for example via phishing or a compromised website.
Google · Chrome
A use-after-free vulnerability in the Quota component of Google Chrome before 156.0.8078.79 can be triggered by a crafted HTML page. A remote attacker may be able to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page; no authentication is needed. Chromium rates the flaw as High severity.
Google · Chrome
Google Chrome before 156.0.8078.79 contains a memory corruption flaw in the Quota component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, and the sandbox limits the impact; full system compromise would generally need a further sandbox escape.
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain a memory corruption flaw in Dawn, Chromium's WebGPU implementation. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires the user to visit the malicious page; the CVSS base score is 8.8 (High).
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain a memory corruption flaw in the GarbageCollection component (CWE-119). A remote attacker can potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The attack needs no authentication, but the victim must visit the page, and Chrome rates the issue High (the NVD score of 9.6 is not yet confirmed). Any SME workstation running an affected Chrome build is exposed.
Google · Chrome
Improper input validation in the V8 JavaScript engine of Google Chrome before 156.0.8078.79 can be abused by a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs a user to visit a crafted HTML page, for example via a phishing link or a compromised website. According to the CNA, the impact is limited to the sandbox; full system compromise would normally require an additional sandbox escape.
Google · Chrome
Google Chrome prior to 156.0.8078.79 contains an improper input validation flaw in the Skia graphics library. A remote attacker can craft an HTML page that could potentially execute arbitrary code outside the browser sandbox. The attack requires that a user visits the crafted page, and no authentication is needed.
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain a use-after-free flaw in the Frames component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, for example through a link in a phishing email.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.
Delinea · Privilege Manager
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
