CVE-20XX-?
agent?

The internet is broken right now.

54 critical CVEs without a fix in the last 48 hours. Somewhere a staging server is public. It always is. 32 more already have a fix that someone still has to apply.

1,243 CVEs · updated 2026-11-14 12:03 UTC

Reset all
  1. CVE-2026-126864

    Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  2. CVE-2026-126896

    Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

    Auth & access Browser & mail

    8.1 HIGH 0.3% exploit odds No fix listed
  3. CVE-2026-126875

    Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

    Auth & access Browser & mail Google Chrome

    8.1 HIGH 0.3% exploit odds Fix listed
  4. CVE-2026-63197

    traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.

    XSS Browser & mail

    7.3 HIGH 0.3% exploit odds Fix listed
  5. CVE-2026-48202

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.

    XSS Browser & mail

    5.3 MEDIUM 0.3% exploit odds No fix listed
  6. CVE-2026-121090

    Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Auth & access Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  7. CVE-2026-113282

    Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  8. CVE-2026-118359

    Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  9. CVE-2026-118357

    Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  10. CVE-2026-113231

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  11. CVE-2026-126915

    Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    7.5 HIGH 0.3% exploit odds Fix listed
  12. CVE-2026-114725

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.

    Other Browser & mail Roundcube Webmail

    5.0 MEDIUM 0.3% exploit odds Fix listed
  13. CVE-2026-113076

    Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  14. CVE-2026-113016

    Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  15. CVE-2026-119262

    Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  16. CVE-2026-113150

    Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  17. CVE-2026-113136

    Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  18. CVE-2026-126918

    Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail

    8.8 HIGH 0.3% exploit odds No fix listed
  19. CVE-2026-126921

    Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail

    8.8 HIGH 0.3% exploit odds No fix listed
  20. CVE-2026-126916

    Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail

    8.8 HIGH 0.3% exploit odds No fix listed
  21. CVE-2026-126899

    Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail

    8.8 HIGH 0.3% exploit odds No fix listed
  22. CVE-2026-126901

    Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail

    8.8 HIGH 0.3% exploit odds No fix listed
  23. CVE-2026-126890

    Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  24. CVE-2026-126893

    Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  25. CVE-2026-121106

    Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium)

    Disclosure Browser & mail Google Chrome

    6.5 MEDIUM 0.3% exploit odds Fix listed
  26. CVE-2026-121038

    Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

    Disclosure Browser & mail Google Chrome

    6.5 MEDIUM 0.3% exploit odds Fix listed
  27. CVE-2026-124952

    Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.

    Memory safety Browser & mail

    8.8 HIGH 0.3% exploit odds Fix listed
  28. CVE-2026-118318

    Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    4.3 MEDIUM 0.3% exploit odds Fix listed
  29. CVE-2026-117893

    Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    5.4 MEDIUM 0.3% exploit odds Fix listed
  30. CVE-2026-113239

    Race condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  31. CVE-2026-113137

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  32. CVE-2026-113115

    Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  33. CVE-2026-113041

    Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  34. CVE-2026-113008

    Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  35. CVE-2026-113075

    Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  36. CVE-2026-113048

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  37. CVE-2026-126849

    Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  38. CVE-2026-118311

    Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  39. CVE-2026-118313

    Out of bounds write in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  40. CVE-2026-118304

    Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  41. CVE-2026-125349

    Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    3.4 LOW 0.3% exploit odds Fix listed
  42. CVE-2026-124941

    Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Disclosure Browser & mail

    4.3 MEDIUM 0.3% exploit odds Fix listed
  43. CVE-2026-117944

    Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  44. CVE-2026-117948

    Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  45. CVE-2026-117934

    Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  46. CVE-2026-117935

    Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  47. CVE-2026-117938

    Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  48. CVE-2026-117939

    Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  49. CVE-2026-117924

    Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  50. CVE-2026-117927

    Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed