Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,161All CVEsplus 18,875 rejected
- 813Last 24 hours3,232 in the last 7 days
- 17,421Last 30 days1,567 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 492 | 2,006 | 1,652 | 168 | 171 | 4,489 | 7,838 |
| 2025 | 20 | 330 | 219 | 9 | 0 | 578 | 3,349 |
| 2024 | 44 | 437 | 209 | 6 | 0 | 696 | 2,771 |
| 2023 | 43 | 301 | 268 | 15 | 0 | 627 | 2,075 |
| 2022 | 16 | 246 | 100 | 0 | 0 | 362 | 1,448 |
| 2021 | 33 | 218 | 102 | 1 | 0 | 354 | 1,086 |
| 2020 | 18 | 136 | 111 | 1 | 0 | 266 | 732 |
| 2019 | 10 | 145 | 198 | 2 | 0 | 355 | 466 |
| 2018 | 3 | 47 | 60 | 1 | 0 | 111 | 111 |
| Title | ||
|---|---|---|
| CVE-2026-120930 | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-120931 | Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via…Google · Chrome | Critical9.6 |
| CVE-2026-121141 | Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin…Google · Chrome | Not scored |
| CVE-2026-121195 | Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121064 | Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the…Google · Chrome | Not scored |
| CVE-2026-121169 | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…Google · Chrome | Not scored |
| CVE-2026-121069 | Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-121142 | Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…Google · Chrome | Not scored |
| CVE-2026-121232 | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information…Google · Chrome | Not scored |
| CVE-2026-121041 | Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121093 | Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted…Google · Chrome | Not scored |
| CVE-2026-121230 | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a…Google · Chrome | High8.3 |
| CVE-2026-121073 | Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via…Google · Chrome | Not scored |
| CVE-2026-121092 | Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…Google · Chrome | High8.8 |
| CVE-2026-121175 | Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121054 | Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121029 | Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121045 | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements…Google · Chrome | Not scored |
| CVE-2026-121162 | UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI…Google · Chrome | Not scored |
| CVE-2026-121225 | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access…Google · Chrome | Not scored |
| CVE-2026-121198 | Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…Google · Chrome | Not scored |
| CVE-2026-121240 | Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted…Google · Chrome | Not scored |
| CVE-2026-121081 | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive…Google · Chrome | Not scored |
| CVE-2026-121050 | Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121205 | Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via…Google · Chrome | Not scored |
| CVE-2026-121204 | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121159 | Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access…Google · Chrome | Not scored |
| CVE-2026-121085 | Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page…Google · Chrome | Not scored |
| CVE-2026-121251 | Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121130 | Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121121 | UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121189 | Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML…Google · Chrome | Critical9.6 |
| CVE-2026-121206 | UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Not scored |
| CVE-2026-121172 | Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121253 | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via…Google · Chrome | Not scored |
| CVE-2026-121165 | UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI…Google · Chrome | Not scored |
| CVE-2026-121236 | Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121101 | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access…Google · Chrome | Not scored |
| CVE-2026-121055 | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome…Google · Chrome | Not scored |
| CVE-2026-121138 | Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121111 | Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121043 | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Not scored |
| CVE-2026-121168 | Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary…Google · Chrome | High8.8 |
| CVE-2026-121252 | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121235 | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium…Google · Chrome | Not scored |
| CVE-2026-121157 | Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local…Google · Chrome | Not scored |
| CVE-2026-121222 | Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | Not scored |
| CVE-2026-121046 | Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar…Google · Chrome | Not scored |
| CVE-2026-121125 | Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain…Google · Chrome | Not scored |
| CVE-2026-121190 | UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Not scored |