CVE-20XX-?
agent?

The internet is broken right now.

53 critical CVEs without a fix in the last 48 hours. Developers are crying quietly into their IDEs. 32 more already have a fix that someone still has to apply.

1,243 CVEs · updated 2026-11-14 11:00 UTC

Reset all
  1. CVE-2026-113014

    Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  2. CVE-2026-113010

    Incomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    6.5 MEDIUM 0.4% exploit odds Fix listed
  3. CVE-2026-113291

    UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  4. CVE-2026-113288

    Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

    Disclosure Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  5. CVE-2026-113260

    Improper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  6. CVE-2026-113189

    Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  7. CVE-2026-118321

    Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  8. CVE-2026-126919

    Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds No fix listed
  9. CVE-2026-121113

    Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  10. CVE-2026-118329

    Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  11. CVE-2026-116695

    Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.

    Other Browser & mail

    5.3 MEDIUM 0.4% exploit odds Fix listed
  12. CVE-2026-54442

    Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

    Disclosure Browser & mail

    4.8 MEDIUM 0.4% exploit odds Fix listed
  13. CVE-2026-17139

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.

    XSS Browser & mail IBM Api Connect

    5.4 MEDIUM 0.4% exploit odds Fix listed
  14. CVE-2026-113306

    Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted file. (Chromium security severity: Low)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  15. CVE-2026-113126

    Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  16. CVE-2026-113111

    Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  17. CVE-2026-113094

    Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  18. CVE-2026-113071

    Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    Crypto Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  19. CVE-2026-113007

    Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  20. CVE-2026-121179

    Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  21. CVE-2026-85330

    Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

    Auth & access Browser & mail Microsoft Edge

    4.3 MEDIUM 0.4% exploit odds Fix listed
  22. CVE-2026-118008

    Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

    Auth & access Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  23. CVE-2026-113245

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  24. CVE-2026-113254

    Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  25. CVE-2026-121183

    Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  26. CVE-2026-113292

    UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  27. CVE-2026-113230

    UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  28. CVE-2026-113226

    UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  29. CVE-2026-113173

    UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  30. CVE-2026-113149

    UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  31. CVE-2026-113138

    UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  32. CVE-2026-113134

    Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  33. CVE-2026-113124

    Improper input validation in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  34. CVE-2026-113117

    Out of bounds read in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  35. CVE-2026-113079

    UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  36. CVE-2026-113068

    UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  37. CVE-2026-113049

    Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Disclosure Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  38. CVE-2026-113056

    Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

    Disclosure Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  39. CVE-2026-112997

    Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

    Disclosure Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  40. CVE-2026-113000

    Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

    Disclosure Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  41. CVE-2026-112992

    Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Disclosure Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  42. CVE-2026-113401

    Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

    Denial of service Browser & mail

    6.5 MEDIUM 0.3% exploit odds Fix listed
  43. CVE-2026-113246

    Missing authorization in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    6.5 MEDIUM 0.3% exploit odds Fix listed
  44. CVE-2026-121224

    Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.1 HIGH 0.3% exploit odds Fix listed
  45. CVE-2026-113216

    Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  46. CVE-2026-113290

    Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  47. CVE-2026-113287

    Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  48. CVE-2026-113265

    Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  49. CVE-2026-113270

    Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  50. CVE-2026-113256

    Improper privilege management in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed