Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-0245 | 4.3 medium | 0.00% | paloaltonetworks, prisma_access_agent | Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected. | Mon 26 Oct |
| CVE-2026-8560 | 4.3 medium | 0.00% | google, chrome | Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-53900 | 4.3 medium | 0.00% | mozilla, firefox_mobile | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0. | Mon 26 Oct |
| CVE-2026-28971 | 4.3 medium | 0.00% | apple, ipados, iphone_os, macos | The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings. | Mon 26 Oct |
| CVE-2026-28917 | 4.3 medium | 0.00% | apple, ipados, iphone_os, macos | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash. | Sun 25 Oct |
| CVE-2026-13842 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13902 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13912 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13916 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13946 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13980 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13981 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13991 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14066 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14075 | 4.3 medium | 0.00% | google, chrome | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14123 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14128 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14136 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14143 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-17762 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sat 24 Oct |
| CVE-2026-17782 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) | 23 Oct |
| CVE-2026-17849 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via malicious network traffic. (Chromium security severity: Medium) | 23 Oct |
| CVE-2026-17912 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-17941 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-17944 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-17960 | 4.3 medium | 0.00% | google, chrome | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-17965 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-17972 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-18003 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-18013 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-18016 | 4.3 medium | 0.00% | google, chrome | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | 23 Oct |
| CVE-2026-20308 | 4.3 medium | 0.00% | no CPE yet | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive. | 23 Oct |
| CVE-2026-86918 | 4.3 medium | 0.00% | no CPE yet | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination. | 20 Oct |
| CVE-2026-86975 | 4.3 medium | 0.00% | no CPE yet | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination. | 20 Oct |
| CVE-2025-43374 | 4.3 medium | 0.00% | apple, ipados, iphone_os, macos | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.5, visionOS 2.5, watchOS 11.5. An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory. | 18 Oct |
| CVE-2025-32900 | 4.3 medium | 0.00% | no CPE yet | In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59. | 18 Oct |
| CVE-2026-0314 | 4.3 medium | 0.00% | no CPE yet | A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability. | 15 Oct |
| CVE-2026-8584 | 4.2 medium | 0.00% | google, chrome | Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13905 | 4.2 medium | 0.00% | google, chrome | Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13907 | 4.2 medium | 0.00% | google, chrome | Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13983 | 4.2 medium | 0.00% | google, chrome | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14028 | 4.2 medium | 0.00% | google, chrome | Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14137 | 4.2 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-17724 | 4.2 medium | 0.00% | google, chrome | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-0295 | 4.1 medium | 0.00% | paloaltonetworks, globalprotect | A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected. | 23 Oct |
| CVE-2025-43205 | 4.0 medium | 0.00% | apple, ipados, iphone_os, tvos | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR. | 18 Oct |
| CVE-2026-28864 | 3.3 low | 0.00% | apple, ipados, iphone_os, macos | This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.7.5, macOS Sequoia 15.8.2, macOS Sonoma 14.8.5, macOS Tahoe 26.4, macOS Tahoe 26.7.2, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items. | Mon 26 Oct |
| CVE-2026-28957 | 3.3 low | 0.00% | apple, ipados, iphone_os, visionos | An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen. | Mon 26 Oct |
| CVE-2025-43294 | 3.3 low | 0.00% | apple, macos | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26, tvOS 26.1, watchOS 26.1. An app may be able to access sensitive user data. | 18 Oct |
| CVE-2025-43344 | 3.3 low | 0.00% | apple, ipados, iphone_os, macos | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to cause unexpected system termination. | 18 Oct |
Download these 718 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.