Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
82,706 matching · page 7/1655Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-121076(opens NVD record) | Critical | 9.6 | Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121075(opens NVD record) | Unscored | — | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121074(opens NVD record) | Critical | 9.6 | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121073(opens NVD record) | Unscored | — | Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121072(opens NVD record) | Unscored | — | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121071(opens NVD record) | Critical | 9.6 | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121070(opens NVD record) | High | 8.8 | Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121069(opens NVD record) | High | 8.8 | Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121068(opens NVD record) | High | 8.8 | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121067(opens NVD record) | Unscored | — | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121066(opens NVD record) | Unscored | — | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121065(opens NVD record) | Unscored | — | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121064(opens NVD record) | Unscored | — | Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121063(opens NVD record) | Unscored | — | Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121062(opens NVD record) | Unscored | — | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121061(opens NVD record) | High | 8.8 | Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121060(opens NVD record) | Critical | 9.6 | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121059(opens NVD record) | Unscored | — | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121057(opens NVD record) | High | 8.8 | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121055(opens NVD record) | Unscored | — | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121054(opens NVD record) | Unscored | — | Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121053(opens NVD record) | Unscored | — | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121052(opens NVD record) | High | 8.8 | Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121051(opens NVD record) | Unscored | — | UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121050(opens NVD record) | Unscored | — | Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121049(opens NVD record) | Unscored | — | Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121048(opens NVD record) | High | 8.8 | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121047(opens NVD record) | High | 8.8 | Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121046(opens NVD record) | Unscored | — | Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121045(opens NVD record) | Unscored | — | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121044(opens NVD record) | High | 8.8 | Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121043(opens NVD record) | Unscored | — | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121042(opens NVD record) | Unscored | — | Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121041(opens NVD record) | Unscored | — | Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-121040(opens NVD record) | Unscored | — | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121039(opens NVD record) | Unscored | — | Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121038(opens NVD record) | Unscored | — | Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121037(opens NVD record) | Critical | 9.6 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121036(opens NVD record) | High | 8.8 | Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121035(opens NVD record) | Critical | 9.6 | Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Nov 3, 2026 |
| CVE-2026-121034(opens NVD record) | Critical | 9.6 | Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121033(opens NVD record) | Unscored | — | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121032(opens NVD record) | Unscored | — | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Nov 3, 2026 |
| CVE-2026-121031(opens NVD record) | Unscored | — | Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121030(opens NVD record) | Critical | 9.6 | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Nov 3, 2026 |
| CVE-2026-121029(opens NVD record) | Unscored | — | Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | Nov 3, 2026 |
| CVE-2026-120959(opens NVD record) | Low | 3.7 | A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once. | Nov 3, 2026 |
| CVE-2026-120952(opens NVD record) | High | 7.1 | An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly. | Nov 3, 2026 |
| CVE-2026-120734(opens NVD record) | Unscored | — | Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host. | Nov 3, 2026 |
| CVE-2026-120733(opens NVD record) | Unscored | — | Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user. | Nov 3, 2026 |