Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
400,551 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-113266 | 8.8 High | Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 20, 2026 |
| CVE-2026-113135 | 8.8 High | Use after free in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113044 | 8.8 High | Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113305 | 8.8 High | Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security… | Oct 20, 2026 |
| CVE-2026-113252 | 9.6 Critical | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security… | Oct 20, 2026 |
| CVE-2026-113234 | 8.8 High | Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113316 | 8.8 High | Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113141 | 8.8 High | Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113284 | 8.8 High | Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113236 | 8.8 High | Improper input validation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.… | Oct 20, 2026 |
| CVE-2026-113315 | 8.8 High | Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113298 | 8.8 High | UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity:… | Oct 20, 2026 |
| CVE-2026-113253 | 8.8 High | Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113163 | 8.8 High | Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113322 | 6.5 Medium | Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113104 | 8.8 High | Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113188 | 8.8 High | Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113117 | 8.8 High | Out of bounds read in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113193 | 6.5 Medium | Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113317 | 8.8 High | Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security… | Oct 20, 2026 |
| CVE-2026-113339 | 8.8 High | Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113134 | 8.8 High | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113092 | 8.8 High | Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity:… | Oct 20, 2026 |
| CVE-2026-113119 | 8.8 High | Improper certificate validation in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113082 | 6.5 Medium | Integer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113058 | 8.8 High | Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113242 | 8.8 High | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113098 | 6.5 Medium | Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113097 | 8.8 High | Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113101 | 8.8 High | Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.… | Oct 20, 2026 |
| CVE-2026-113303 | 8.8 High | Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113271 | 8.8 High | Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113280 | 8.8 High | Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113072 | 9.6 Critical | Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113279 | 8.8 High | Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113341 | 6.5 Medium | Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-112712 | 9.1 Critical | @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch | Oct 20, 2026 |
| CVE-2026-112407 | 8.7 High | Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications | Oct 20, 2026 |
| CVE-2016-20104 | 8.7 High | EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php | Oct 20, 2026 |
| CVE-2016-20103 | 8.7 High | Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php | Oct 20, 2026 |
| CVE-2016-20102 | 5.1 Medium | JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter | Oct 20, 2026 |
| CVE-2016-20101 | 9.2 Critical | Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php | Oct 20, 2026 |
| CVE-2016-20100 | 8.7 High | Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview | Oct 20, 2026 |
| CVE-2015-20128 | 8.8 High | FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx | Oct 20, 2026 |
| CVE-2015-20125 | 8.7 High | Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php | Oct 20, 2026 |
| CVE-2015-20124 | 8.7 High | Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php | Oct 20, 2026 |
| CVE-2015-20123 | 8.7 High | Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php | Oct 20, 2026 |
| CVE-2014-125134 | 8.7 High | ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php | Oct 20, 2026 |
| CVE-2014-125133 | 8.7 High | NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php | Oct 20, 2026 |
| CVE-2014-125132 | 5.1 Medium | Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.