Export limit exceeded: 409668 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (409668 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-113289 1 Google 1 Chrome 2026-11-04 8.8 High
Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-112999 1 Google 1 Chrome 2026-11-04 8.8 High
Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113307 1 Google 1 Chrome 2026-11-04 8.8 High
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113897 1 Apple 6 Ios And Ipados, Ipados, Iphone Os and 3 more 2026-11-04 10 Critical
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.
CVE-2026-119977 2 Wordpress, Wordpress Foundation 2 Wordpress, Wordpress 2026-11-04 8.1 High
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CVE-2026-14330 2 Pipewire, Redhat 5 Pipewire, Enterprise Linux, Enterprise Linux Eus and 2 more 2026-11-04 5.5 Medium
Multiple unbounded alloca() calls in the PulseAudio protocol server.
CVE-2026-14324 2 Pipewire, Redhat 5 Pipewire, Enterprise Linux, Enterprise Linux Eus and 2 more 2026-11-04 6.5 Medium
RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
CVE-2026-113160 1 Google 1 Chrome 2026-11-04 8.8 High
Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113212 1 Google 1 Chrome 2026-11-04 8.8 High
Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-113176 1 Google 1 Chrome 2026-11-04 8.8 High
Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-113150 1 Google 1 Chrome 2026-11-04 8.8 High
Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113078 1 Google 1 Chrome 2026-11-04 9.6 Critical
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113026 1 Google 2 Android, Chrome 2026-11-04 6.5 Medium
Information loss in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113333 1 Google 1 Chrome 2026-11-04 6.5 Medium
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113127 1 Google 1 Chrome 2026-11-04 8.8 High
Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113129 1 Google 1 Chrome 2026-11-04 6.5 Medium
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113220 1 Google 2 Android, Chrome 2026-11-04 8.8 High
Missing authorization in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113275 1 Google 1 Chrome 2026-11-04 8.8 High
Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-28643 1 Google 1 Android 2026-11-04 6.2 Medium
In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59047 1 Google 1 Android 2026-11-04 6.2 Medium
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.