CVE-20XX-?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

2 CVEs · updated 2026-11-06 08:39 UTC

Reset all
  1. CVE-2026-85046

    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    exploited Code execution Browser & mail Google Chrome

    8.8 HIGH 2% exploit odds Fix listed
  2. CVE-2026-34621

    Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

    exploited Code execution Browser & mail Adobe Acrobat Dc

    8.6 HIGH 7% exploit odds Fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.