Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-12007 | 8.8 high | 0.00% | google, chrome | Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-12020 | 8.8 high | 0.00% | google, chrome | Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-12035 | 8.8 high | 0.00% | google, chrome | Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-12439 | 8.8 high | 0.00% | google, chrome | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-12442 | 8.8 high | 0.00% | google, chrome | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-12447 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-12448 | 8.8 high | 0.00% | google, chrome | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6299 | 8.8 high | 0.00% | google, chrome | Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-6360 | 8.8 high | 0.00% | google, chrome | Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7903 | 8.8 high | 0.00% | google, chrome | Integer overflow in ANGLE in Google Chrome on Mac,Windows prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7926 | 8.8 high | 0.00% | google, chrome | Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7927 | 8.8 high | 0.00% | google, chrome | Type Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8016 | 8.8 high | 0.00% | google, chrome | Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-8529 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8581 | 8.8 high | 0.00% | google, chrome | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7940 | 8.8 high | 0.00% | google, chrome | Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-12018 | 8.8 high | 0.00% | google, chrome | Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-0132 | 8.8 high | 0.00% | google, android | In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0139 | 8.8 high | 0.00% | google, android | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0146 | 8.8 high | 0.00% | google, android | In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0147 | 8.8 high | 0.00% | google, android | In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0148 | 8.8 high | 0.00% | google, android | In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0149 | 8.8 high | 0.00% | google, android | In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0151 | 8.8 high | 0.00% | google, android | In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0154 | 8.8 high | 0.00% | google, android | In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0160 | 8.8 high | 0.00% | google, android | In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0161 | 8.8 high | 0.00% | google, android | In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0162 | 8.8 high | 0.00% | google, android | In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0164 | 8.8 high | 0.00% | google, android | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-12441 | 8.8 high | 0.00% | google, chrome | Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-12466 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13026 | 8.8 high | 0.00% | google, chrome | Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13027 | 8.8 high | 0.00% | google, chrome | Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13031 | 8.8 high | 0.00% | google, chrome | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13033 | 8.8 high | 0.00% | google, chrome | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13035 | 8.8 high | 0.00% | google, chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13036 | 8.8 high | 0.00% | google, chrome | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13038 | 8.8 high | 0.00% | google, chrome | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13825 | 8.8 high | 0.00% | google, chrome | Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13830 | 8.8 high | 0.00% | google, chrome | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13835 | 8.8 high | 0.00% | google, chrome | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13845 | 8.8 high | 0.00% | google, chrome | Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13848 | 8.8 high | 0.00% | google, chrome | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13850 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13884 | 8.8 high | 0.00% | google, chrome | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13885 | 8.8 high | 0.00% | google, chrome | Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13888 | 8.8 high | 0.00% | google, chrome | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13897 | 8.8 high | 0.00% | google, chrome | Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13898 | 8.8 high | 0.00% | google, chrome | Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13899 | 8.8 high | 0.00% | google, chrome | Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.