Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 24 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-121089 Chromium CVE-2026-121089: Use after free

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome

    Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-121131 Chromium CVE-2026-121131: Use after free

    CriticalCVSS 9.6 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: Microsoft Edge (Chromium-based), debian/chromium, Google Chrome

    Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-121086 Chromium CVE-2026-121086: Buffer overflow

    CriticalCVSS 9.6 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome and 5 more

    Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-121037 Chromium CVE-2026-121037: Out of bounds write

    CriticalCVSS 9.6 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome and 7 more

    Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-121071 Chromium CVE-2026-121071: Incorrect authorization

    CriticalCVSS 9.6 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: Google Chrome, debian/chromium, Microsoft edge chromium

    Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-121185 Chromium CVE-2026-121185: Use after free

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome

    Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-121074 chromium-browser: Memory corruption in GPU

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Google Chrome, debian/chromium

    Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-121247 chromium-browser: Buffer overflow in Dawn

    CriticalCVSS 9.6 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: Google Chrome, debian/chromium

    Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-121126 Chromium CVE-2026-121126: Use after free

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome

    Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-121035 Chromium CVE-2026-121035: Use after free

    CriticalCVSS 9.6 EPSS 0.44%

    Exploit status: No public exploit known

    Affects: Microsoft edge chromium, debian/chromium, Google Chrome

    Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-121156 Chromium CVE-2026-121156: Buffer overflow

    CriticalCVSS 9.6 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: Google Chrome, debian/chromium, Microsoft edge chromium

    Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-121246 chromium-browser: Use after free in WebGL

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Google Chrome, debian/chromium

    Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-121229 chromium-browser: angle: Memory corruption in ANGLE

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Google Chrome, redhat/firefox, redhat/thunderbird and 6 more

    Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-115731 Report Deserialization Code Execution

    CriticalCVSS 9.4 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: redhat/openvox-server, redhat/python-pyyaml, redhat/openvox-agent and 5 more

    Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report cont...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-115732 Certificate Name Authorization Bypass

    CriticalCVSS 9.0 EPSS 0.75%

    Exploit status: No public exploit known

    Affects: redhat/openvox-server, redhat/python-pyyaml, redhat/openvox-agent and 4 more

    Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. Thi...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-95860 node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

    CriticalCVSS 9.1 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: node-opcua, npm node-opcua, npm node-opcua-address-space and 1 more

    node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionCon...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution

    CriticalCVSS 9.6 EPSS 0.22%

    Exploit status: No public exploit known

    Affects: Hewlett Packard Enterprise (HPE) Fabric Composer

    A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution

    CriticalCVSS 9.6 EPSS 0.29%

    Exploit status: No public exploit known

    Affects: Hewlett Packard Enterprise (HPE) Fabric Composer

    An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access

    CriticalCVSS 9.8 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: Hewlett Packard Enterprise (HPE) Fabric Composer

    Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized admini...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

    CriticalCVSS 9.3 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: pypi fastapi-code-generator, koxudaxi fastapi-code-generator

    fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).