CVE-20XX-?
agent?

The internet is broken right now.

88 critical CVEs without a fix in the last 48 hours. Developers are crying quietly into their IDEs. 23 more already have a fix that someone still has to apply.

1,280 CVEs · updated 2026-11-12 21:12 UTC

Reset all
  1. CVE-2026-120572

    Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1 and Thunderbird 160.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  2. CVE-2026-117978

    Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.1 HIGH 0.4% exploit odds Fix listed
  3. CVE-2026-117952

    Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Other Browser & mail

    8.1 HIGH 0.4% exploit odds Fix listed
  4. CVE-2026-117926

    Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.1 HIGH 0.4% exploit odds Fix listed
  5. CVE-2026-117886

    Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.1 HIGH 0.4% exploit odds Fix listed
  6. CVE-2026-117873

    Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.1 HIGH 0.4% exploit odds Fix listed
  7. CVE-2026-112666

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.

    Memory safety Browser & mail Apple Safari

    4.3 MEDIUM 0.4% exploit odds Fix listed
  8. CVE-2026-113274

    Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  9. CVE-2026-121131

    Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  10. CVE-2026-124897

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  11. CVE-2026-124889

    Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  12. CVE-2026-124892

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  13. CVE-2026-124893

    Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  14. CVE-2026-124894

    Use-after-free in the Networking: Cookies component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  15. CVE-2026-124883

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  16. CVE-2026-124884

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  17. CVE-2026-124866

    Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  18. CVE-2026-124869

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  19. CVE-2026-124862

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  20. CVE-2026-117994

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  21. CVE-2026-117997

    Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    9.6 CRITICAL 0.4% exploit odds Fix listed
  22. CVE-2026-117983

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  23. CVE-2026-117985

    Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    9.6 CRITICAL 0.4% exploit odds Fix listed
  24. CVE-2026-117986

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  25. CVE-2026-117987

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  26. CVE-2026-117989

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  27. CVE-2026-117972

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  28. CVE-2026-117973

    Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  29. CVE-2026-117964

    Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  30. CVE-2026-117953

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  31. CVE-2026-117940

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  32. CVE-2026-117932

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  33. CVE-2026-117920

    Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    9.6 CRITICAL 0.4% exploit odds Fix listed
  34. CVE-2026-117904

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

    Memory safety Browser & mail

    8.8 HIGH 0.4% exploit odds Fix listed
  35. CVE-2026-113299

    Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  36. CVE-2026-113301

    Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  37. CVE-2026-113294

    Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  38. CVE-2026-113234

    Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  39. CVE-2026-113215

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  40. CVE-2026-113202

    Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  41. CVE-2026-113183

    Incorrect authorization in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  42. CVE-2026-113174

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  43. CVE-2026-113120

    Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  44. CVE-2026-113123

    Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  45. CVE-2026-113106

    Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  46. CVE-2026-113087

    Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  47. CVE-2026-113081

    Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  48. CVE-2026-113073

    Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

    XSS Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  49. CVE-2026-113053

    Incorrect authorization in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

    Auth & access Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  50. CVE-2026-113031

    Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed