IT SBIT Services
Schneeberger
DEEN
CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.

55published today
3,299in the last 7 days
17,440in the last 30 days
265critical (7 days)
6newly exploited (7 days)
300with a public exploit (30 days)

New CVEs in the last 30 days by severity

  • Critical
  • High
  • Medium
  • Low
  • Not rated
01,0002,0003,000Tue, 6 Oct 2026: 1,014 CVE (Critical 105, High 371, Medium 345, Low 38, Not rated 155)6 OctWed, 7 Oct 2026: 340 CVE (Critical 53, High 131, Medium 145, Low 9, Not rated 2)Thu, 8 Oct 2026: 497 CVE (Critical 62, High 194, Medium 220, Low 21)Fri, 9 Oct 2026: 315 CVE (Critical 42, High 152, Medium 105, Low 11, Not rated 5)Sat, 10 Oct 2026: 412 CVE (Critical 78, High 143, Medium 178, Low 13)Sun, 11 Oct 2026: 229 CVE (Critical 16, High 73, Medium 101, Low 39)11 OctMon, 12 Oct 2026: 674 CVE (Critical 48, High 264, Medium 282, Low 80)Tue, 13 Oct 2026: 2,303 CVE (Critical 170, High 1,361, Medium 729, Low 43)Wed, 14 Oct 2026: 824 CVE (Critical 92, High 374, Medium 285, Low 30, Not rated 43)Thu, 15 Oct 2026: 546 CVE (Critical 51, High 232, Medium 244, Low 19)Fri, 16 Oct 2026: 465 CVE (Critical 53, High 179, Medium 219, Low 14)16 OctSat, 17 Oct 2026: 100 CVE (Critical 4, High 42, Medium 50, Low 4)Sun, 18 Oct 2026: 549 CVE (Critical 10, High 55, Medium 65, Low 19, Not rated 400)Mon, 19 Oct 2026: 437 CVE (Critical 32, High 133, Medium 206, Low 66)Tue, 20 Oct 2026: 1,923 CVE (Critical 169, High 815, Medium 812, Low 127)Wed, 21 Oct 2026: 542 CVE (Critical 52, High 218, Medium 225, Low 47)21 OctThu, 22 Oct 2026: 492 CVE (Critical 69, High 161, Medium 208, Low 54)Fri, 23 Oct 2026: 492 CVE (Critical 40, High 170, Medium 91, Low 27, Not rated 164)Sat, 24 Oct 2026: 73 CVE (Critical 12, High 20, Medium 35, Low 6)Sun, 25 Oct 2026: 131 CVE (Critical 4, High 35, Medium 66, Low 26)Mon, 26 Oct 2026: 738 CVE (Critical 29, High 216, Medium 335, Low 65, Not rated 93)26 OctTue, 27 Oct 2026: 648 CVE (Critical 69, High 188, Medium 177, Low 33, Not rated 181)Wed, 28 Oct 2026: 626 CVE (Critical 35, High 224, Medium 214, Low 31, Not rated 122)Thu, 29 Oct 2026: 537 CVE (Critical 82, High 204, Medium 223, Low 22, Not rated 6)Fri, 30 Oct 2026: 668 CVE (Critical 44, High 219, Medium 262, Low 30, Not rated 113)Sat, 31 Oct 2026: 112 CVE (Critical 11, High 44, Medium 51, Low 1, Not rated 5)31 OctSun, 1 Nov 2026: 98 CVE (Critical 8, High 24, Medium 27, Low 15, Not rated 24)Mon, 2 Nov 2026: 476 CVE (Critical 26, High 188, Medium 169, Low 20, Not rated 73)Tue, 3 Nov 2026: 732 CVE (Critical 55, High 227, Medium 235, Low 36, Not rated 179)Wed, 4 Nov 2026: 55 CVE (Critical 5, High 21, Medium 7, Low 2, Not rated 20)4 Nov

Per day (UTC); hover over a bar for the figures.

Show as table
DayCriticalHighMediumLowNot ratedTotal
Wed, 4 Nov 2026521722055
Tue, 3 Nov 20265522723536179732
Mon, 2 Nov 2026261881692073476
Sun, 1 Nov 202682427152498
Sat, 31 Oct 202611445115112
Fri, 30 Oct 20264421926230113668
Thu, 29 Oct 202682204223226537
Wed, 28 Oct 20263522421431122626
Tue, 27 Oct 20266918817733181648
Mon, 26 Oct 2026292163356593738
Sun, 25 Oct 202643566260131
Sat, 24 Oct 20261220356073
Fri, 23 Oct 2026401709127164492
Thu, 22 Oct 202669161208540492
Wed, 21 Oct 202652218225470542
Tue, 20 Oct 202616981581212701,923
Mon, 19 Oct 202632133206660437
Sun, 18 Oct 202610556519400549
Sat, 17 Oct 20264425040100
Fri, 16 Oct 202653179219140465
Thu, 15 Oct 202651232244190546
Wed, 14 Oct 2026923742853043824
Tue, 13 Oct 20261701,3617294302,303
Mon, 12 Oct 202648264282800674
Sun, 11 Oct 20261673101390229
Sat, 10 Oct 202678143178130412
Fri, 9 Oct 202642152105115315
Thu, 8 Oct 202662194220210497
Wed, 7 Oct 20265313114592340
Tue, 6 Oct 2026105371345381551,014

3,299 vulnerabilities

CVE-2026-107252Medium 5.4

Research and translation in progress – available shortly.

CVE-2026-107251Medium 6.5

Research and translation in progress – available shortly.

CVE-2026-107250Medium 5.9

Research and translation in progress – available shortly.

CVE-2026-107249Critical 9.8

Drupal Block AJAX: PHP object injection via unvalidated block data

The Drupal contrib module Block AJAX (block_ajax) does not sufficiently validate user-supplied data it uses to construct a block. In the worst case, this can lead to PHP object injection and remote code execution. According to Drupal, the issue only affects sites with Layout Builder enabled or another block plugin that handles the data unsafely; the authentication requirements are not yet confirmed.

Drupal · Block AJAX

CVE-2026-91920Medium 6.5

Research and translation in progress – available shortly.

CVE-2026-74915Not rated

Research and translation in progress – available shortly.

CVE-2026-74912Not rated

Research and translation in progress – available shortly.

CVE-2026-65587Not rated

Research and translation in progress – available shortly.

CVE-2026-65586Not rated

Research and translation in progress – available shortly.

CVE-2026-65584Not rated

Research and translation in progress – available shortly.

CVE-2026-19199Not rated

Research and translation in progress – available shortly.

CVE-2026-18629Not rated

Research and translation in progress – available shortly.

CVE-2026-15466Not rated

Research and translation in progress – available shortly.

CVE-2026-118475Low 3.6

Research and translation in progress – available shortly.

CVE-2026-112922Low 3.3

Research and translation in progress – available shortly.

CVE-2026-76031High 8.8

Google Chrome: Incorrect authorization in Input bypasses web origin policy

Google Chrome for desktop prior to 156.0.8078.79 contains an incorrect authorization flaw in the Input component. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page, which requires social engineering. The official CVE record rates the impact as high (CVSS 8.8), but the Chrome release notes describe the flaw as a use-after-free, so the description should be verified against NVD and the vendor advisory.

Google · Chrome

CVE-2026-76030High 8.8

Google Chrome: Incorrect authorization in FileSystem

A flaw in the FileSystem component of Google Chrome before 156.0.8078.79 may allow a remote attacker to potentially execute arbitrary code. The CVE data describes incorrect authorization (CWE-863) that could allow code execution outside the sandbox, and it requires a user to open a crafted HTML page after social engineering. Sources disagree on the description, CWE and CVSS score (some trackers list memory corruption, CWE-119, code execution inside the sandbox and CVSS 6.3), so the exact impact must be verified against the NVD record.

Google · Chrome

CVE-2026-76029High 8.8

Google Chrome: Improper input validation in Network

Google Chrome before 156.0.8078.79 contains an improper input validation flaw in its Network component (CVE-2026-76029, rated High by Chromium). According to the CVE text, a remote attacker can execute arbitrary code inside the browser sandbox by sending crafted network traffic. Other sources describe a memory corruption flaw triggered by a crafted HTML page, so the exact conditions and the CVSS score of 8.8 must be verified against the NVD entry.

Google · Chrome

CVE-2026-76028High 8.8

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in its FileSystem component (CWE-863 in the CVE record). A remote attacker who lures a user to a crafted HTML page can, with social engineering, execute arbitrary code outside the sandbox. The CVE record rates it High (CVSS 8.8), but other sources differ on the bug class and score, so the vendor fix should be applied regardless.

Google · Chrome

CVE-2026-76026High 8.8

Google Chrome: Origin validation error in Autofill

Google Chrome prior to 156.0.8078.79 contains an origin validation error in its Autofill feature (CWE-346, CVSS 8.8 per the supplied data). A remote attacker can use a crafted HTML page to bypass the web origin policy, and the victim must open that page. Secondary sources describe this issue as a memory corruption bug (CWE-119, VulDB CVSS 6.3), and the NVD record was still pending, so the details should be verified.

Google · Chrome

CVE-2026-119271High 8.8

Google Chrome: Uninitialized resource in Skia enables memory read

Google Chrome versions prior to 156.0.8078.79 contain an uninitialized resource flaw in the Skia graphics library. An attacker who has already compromised the renderer process can use a crafted HTML page to read memory outside the sandbox. The attack requires a user to visit the page, and the vendor rates the Chromium security severity as High. The CVE record and the research notes disagree on the weakness type (CWE-908 versus use-after-free), so the NVD record should be checked.

Google · Chrome

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed