CVE-20XX-?
agent?

The internet is broken right now.

53 critical CVEs without a fix in the last 48 hours. Somewhere a staging server is public. It always is. 31 more already have a fix that someone still has to apply.

1,243 CVEs · updated 2026-11-14 12:20 UTC

Reset all
  1. CVE-2026-118352

    Use after free in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  2. CVE-2026-118356

    Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  3. CVE-2026-118341

    Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  4. CVE-2026-118343

    Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  5. CVE-2026-118347

    Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  6. CVE-2026-118349

    Use after free in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  7. CVE-2026-118334

    Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  8. CVE-2026-121212

    Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  9. CVE-2026-121171

    Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  10. CVE-2026-76024

    Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

    Memory safety Browser & mail Google Chrome

    6.5 MEDIUM 0.3% exploit odds Fix listed
  11. CVE-2026-113344

    Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  12. CVE-2026-113032

    Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  13. CVE-2026-121121

    UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    5.4 MEDIUM 0.3% exploit odds Fix listed
  14. CVE-2026-121122

    UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    5.4 MEDIUM 0.3% exploit odds Fix listed
  15. CVE-2026-117947

    Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  16. CVE-2026-117916

    Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  17. CVE-2026-117909

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  18. CVE-2026-117913

    Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  19. CVE-2026-117898

    Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  20. CVE-2026-117902

    Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  21. CVE-2026-117877

    Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  22. CVE-2026-117885

    Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  23. CVE-2026-117875

    Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  24. CVE-2026-117865

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    6.3 MEDIUM 0.3% exploit odds Fix listed
  25. CVE-2026-121073

    Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)

    Memory safety Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  26. CVE-2026-76031

    Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  27. CVE-2026-113196

    Race condition in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    6.5 MEDIUM 0.3% exploit odds Fix listed
  28. CVE-2026-121251

    Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  29. CVE-2026-121252

    Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  30. CVE-2026-121222

    Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  31. CVE-2026-121205

    Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  32. CVE-2026-121107

    Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  33. CVE-2026-121108

    Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  34. CVE-2026-121102

    Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  35. CVE-2026-121091

    Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    5.3 MEDIUM 0.3% exploit odds Fix listed
  36. CVE-2026-121065

    Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  37. CVE-2026-124637

    A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.

    XSS Browser & mail

    5.3 MEDIUM 0.3% exploit odds No fix listed
  38. CVE-2026-113180

    Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Low)

    Disclosure Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  39. CVE-2026-113169

    UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Low)

    Other Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  40. CVE-2026-113171

    UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  41. CVE-2026-113400

    Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

    Memory safety Browser & mail

    5.4 MEDIUM 0.3% exploit odds Fix listed
  42. CVE-2026-118027

    Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.

    Other Browser & mail

    9.1 CRITICAL 0.3% exploit odds Fix listed
  43. CVE-2026-120520

    The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references in {{GET:key}})' parameter. This makes it possible for unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim's browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker's crafted link — neither condition is part of the plugin's default state.

    Disclosure Browser & mail

    5.3 MEDIUM 0.3% exploit odds No fix listed
  44. CVE-2026-121236

    Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  45. CVE-2026-121135

    Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  46. CVE-2026-121120

    Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  47. CVE-2026-121087

    Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  48. CVE-2026-58497

    Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.

    Other Browser & mail

    8.6 HIGH 0.3% exploit odds Fix listed
  49. CVE-2026-113186

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  50. CVE-2026-121050

    Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed