Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,369 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-118343 | 8.8 High | Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118359 | 8.8 High | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118327 | 8.8 High | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118349 | 8.8 High | Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118353 | 8.8 High | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118358 | 8.8 High | Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118336 | 8.8 High | Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118333 | 5.4 Medium | Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118328 | 8.8 High | Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118351 | 8.8 High | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118307 | 8.8 High | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118355 | 9.6 Critical | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118352 | 8.8 High | Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118337 | 5.4 Medium | Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118321 | 9.6 Critical | Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118340 | 9.6 Critical | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118354 | 8.8 High | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118329 | 8.8 High | Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118322 | 4.3 Medium | Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118320 | 8.8 High | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118317 | 8.8 High | Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118305 | 9.6 Critical | Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118339 | 8.8 High | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118350 | 8.8 High | Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118318 | 4.3 Medium | Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118357 | 8.8 High | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118344 | 8.8 High | Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 27, 2026 |
| CVE-2026-118348 | 8.8 High | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 27, 2026 |
| CVE-2026-118331 | 8.8 High | Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 27, 2026 |
| CVE-2026-118306 | 9.6 Critical | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 27, 2026 |
| CVE-2026-50571 | 5.7 Medium | WebSub: Reflected script execution through intent-verification challenges | Oct 27, 2026 |
| CVE-2026-59158 | 7.5 High | Nuxt Ollama: public runtime configuration discloses the configured cloud API key | Oct 27, 2026 |
| CVE-2026-58257 | 7.2 High | GRR vulnerable to Arbitrary File Read and Deletion | Oct 27, 2026 |
| CVE-2026-58256 | 9.1 Critical | GRR vulnerable to Remote Code Execution Via PHP Code Injection | Oct 27, 2026 |
| CVE-2026-58255 | 8.8 High | Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401 | Oct 27, 2026 |
| CVE-2026-58205 | 8.1 High | GRR has a Reflected XSS issue | Oct 27, 2026 |
| CVE-2026-22063 | 6.0 Medium | CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products | Oct 27, 2026 |
| CVE-2026-58496 | 4.3 Medium | ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API | Oct 27, 2026 |
| CVE-2026-118128 | 6.9 Medium | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition | Oct 27, 2026 |
| CVE-2026-57199 | 2.3 Low | Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers | Oct 27, 2026 |
| CVE-2026-57203 | 6.9 Medium | Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location | Oct 27, 2026 |
| CVE-2026-57190 | 7.0 High | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field | Oct 27, 2026 |
| CVE-2026-97045 | Not scored | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net | Oct 27, 2026 |
| CVE-2026-78661 | Not scored | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net | Oct 27, 2026 |
| CVE-2026-62765 | 7.5 High | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | Oct 27, 2026 |
| CVE-2026-57191 | 8.2 High | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing | Oct 27, 2026 |
| CVE-2026-57192 | 6.0 Medium | Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch | Oct 27, 2026 |
| CVE-2026-57186 | 7.5 High | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser | Oct 27, 2026 |
| CVE-2026-57200 | 7.5 High | Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE | Oct 27, 2026 |
| CVE-2026-57195 | 7.5 High | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication | Oct 27, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.