Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2023-3079KEVexploit | 8.8 high | 38.0% | google, fedoraproject, chrome, fedora, debian_linux | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | 8 Oct |
| CVE-2011-3389exploit ×2 | 4.3 medium | 73.0% | google, microsoft, chrome, internet_explorer, firefox | The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. | 9 Oct |
| CVE-2026-0628exploit ×2 | 8.8 high | 21.0% | google, chrome | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-76036exploit | 9.6 critical | 1.0% | google, chrome | Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Thu 22 Oct |
| CVE-2026-110152exploit | 9.6 critical | 1.0% | google, chrome | Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 15 Oct |
| CVE-2026-13934exploit | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14382exploit | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-7899exploit | 8.8 high | 0.00% | google, chrome | Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6300exploit | 8.8 high | 0.00% | google, chrome | Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6307exploit ×2 | 8.8 high | 0.00% | google, chrome | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-14431exploit | 8.8 high | 0.00% | google, chrome | Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-110922exploit | 8.8 high | 0.00% | google, chrome | Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 19 Oct |
| CVE-2026-8510 | 7.5 high | 10.0% | google, chrome | Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-54069 | 9.2 critical | 7.0% | no CPE yet | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0. | Sun 25 Oct |
| CVE-2020-10531 | 8.8 high | 3.0% | icu-project, redhat, international_components_for_unicode, enterprise_linux_desktop, enterprise_linux_server | An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. | 14 Oct |
| CVE-2017-15422 | 6.5 medium | 3.0% | google, icu-project, chrome, international_components_for_unicode, debian_linux | Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | 14 Oct |
| CVE-2016-5131 | 8.8 high | 2.0% | google, xmlsoft, chrome, libxml2, iphone_os | Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. | 14 Oct |
| CVE-2026-48294 | 7.4 high | 2.0% | adobe, acrobat | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | Mon 26 Oct |
| CVE-2025-65108 | 10.0 critical | 1.0% | no CPE yet | md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5. | 18 Oct |
| CVE-2026-14104 | 9.8 critical | 1.0% | google, chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-53633 | 9.8 critical | 1.0% | no CPE yet | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta. | Sat 24 Oct |
| CVE-2026-6296 | 9.6 critical | 1.0% | google, chrome | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-14405 | 9.6 critical | 1.0% | google, chrome | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-17655 | 9.6 critical | 1.0% | google, chrome | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sat 24 Oct |
| CVE-2026-17671 | 9.6 critical | 1.0% | google, chrome | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17682 | 9.6 critical | 1.0% | google, chrome | Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17687 | 9.6 critical | 1.0% | google, chrome | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17697 | 9.6 critical | 1.0% | google, chrome | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17704 | 9.6 critical | 1.0% | google, chrome | Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17717 | 9.6 critical | 1.0% | google, chrome | Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-113072 | 9.6 critical | 1.0% | google, chrome | Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Thu 22 Oct |
| CVE-2026-106358 | 9.6 critical | 1.0% | google, chrome | Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 14 Oct |
| CVE-2026-106197 | 9.6 critical | 1.0% | google, chrome | Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 8 Oct |
| CVE-2026-73032 | 9.4 critical | 1.0% | no CPE yet | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data. | Sat 24 Oct |
| CVE-2023-0698 | 8.8 high | 1.0% | google, chrome | Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) | 14 h ago |
| CVE-2026-5272 | 8.8 high | 1.0% | google, chrome | Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5287 | 8.8 high | 1.0% | google, chrome | Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-113080 | 8.8 high | 1.0% | google, chrome | Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-12443 | 8.8 high | 1.0% | google, chrome | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-13870 | 8.8 high | 1.0% | google, chrome | Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-15121 | 8.8 high | 1.0% | google, chrome | Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-16420 | 8.8 high | 1.0% | google, chrome | Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-16421 | 8.8 high | 1.0% | google, chrome | Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-16806 | 8.8 high | 1.0% | google, chrome | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17678 | 8.8 high | 1.0% | google, chrome | Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17881 | 8.8 high | 1.0% | google, chrome | Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-113163 | 8.8 high | 1.0% | google, chrome | Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Fri 23 Oct |
| CVE-2026-112994 | 8.8 high | 1.0% | google, chrome | Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | Fri 23 Oct |
| CVE-2026-113147 | 8.8 high | 1.0% | google, chrome | Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Thu 22 Oct |
| CVE-2026-76034 | 8.8 high | 1.0% | google, chrome | Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Thu 22 Oct |
50 of 1909 · Next
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.