Export limit exceeded: 417326 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 417326 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 417326 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 417326 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found 'ål' (at char 35), (line:1, col:36)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (417326 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-20942 1 Microsoft 2 Edge Chromium, Microsoft Edge (chromium-based) 2026-10-30 4.3 Medium
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-13002 1 Redhat 2 Enterprise Linux, Openshift Container Platform 2026-10-30 N/A
Rejected as this CVE is duplicate to CVE-2026-4890.
CVE-2026-119578 1 Project-monai 1 Monai 2026-10-30 7.8 High
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.
CVE-2026-119272 1 Google 1 Chrome 2026-10-30 4.3 Medium
Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-119271 1 Google 1 Chrome 2026-10-30 8.8 High
Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119270 1 Google 1 Chrome 2026-10-30 8.8 High
Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119269 1 Google 1 Chrome 2026-10-30 8.8 High
Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119268 1 Google 1 Chrome 2026-10-30 8.8 High
Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119267 1 Google 1 Chrome 2026-10-30 8.8 High
Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119266 1 Google 1 Chrome 2026-10-30 8.8 High
Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119265 1 Google 1 Chrome 2026-10-30 8.8 High
Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119264 1 Google 1 Chrome 2026-10-30 8.8 High
Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119263 1 Google 1 Chrome 2026-10-30 9.6 Critical
Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119262 1 Google 1 Chrome 2026-10-30 8.8 High
Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119261 1 Google 1 Chrome 2026-10-30 9.6 Critical
Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119260 1 Google 1 Chrome 2026-10-30 8.8 High
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118337 1 Google 1 Chrome 2026-10-30 5.4 Medium
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118333 1 Google 1 Chrome 2026-10-30 5.4 Medium
Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118165 2026-10-30 6.8 Medium
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.
CVE-2026-118101 2026-10-30 5.3 Medium
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.