4073
CVEs
437
Critical
1680
High
12
KEV
149
PoC
364
Unpatched C/H
82.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
437
HIGH
1680
MEDIUM
1720
LOW
226
Monthly CVE Trend
Affected Products (30)
Android
6835
Chrome
3156
Debian Linux
1027
Fedora
887
Opensuse
547
Linux Kernel
486
Tensorflow
369
Enterprise Linux Server
300
Enterprise Linux Desktop
297
Enterprise Linux Workstation
297
Leap
282
Wordpress Plugin
256
Edge Chromium
191
Flash Player
188
Backports Sle
185
Java
155
Yocto
136
Firefox
129
Ubuntu Linux
129
PHP
109
Adobe Air
89
Adobe Air Sdk
87
Air
80
Microsoft Edge Chromium Based
76
Backports
70
Air Sdk
69
Ubuntu
63
Enterprise Linux Workstation Supplementary
59
Python
58
Openwrt
57
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85046 | Type confusion in V8 (Chrome's JavaScript engine) in versions prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within Chrome's renderer sandbox by enticing a user to visit a specially crafted HTML page. The flaw exploits V8's type system, allowing an attacker to manipulate object type metadata in the JavaScript heap to gain controlled memory access and code execution inside the renderer process. No public exploit or CISA KEV listing has been identified at time of analysis, though V8 type confusion vulnerabilities in Chrome have historically attracted rapid weaponization given the browser's enormous attack surface and attacker interest. | HIGH | 8.8 | 0.5% | 119 |
KEV
PoC
|
| CVE-2026-87491 | Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. Impact is bounded by Chrome's renderer sandbox - an attacker achieves control over the renderer process and can access browser-stored data such as session cookies and saved credentials, but reaching the host OS would require a separately chained sandbox escape exploit. No public exploit identified at time of analysis. | HIGH | 8.8 | 0.3% | 119 |
KEV
PoC
|
| CVE-2026-11645 | Remote code execution in Google Chrome's V8 JavaScript engine prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside the renderer sandbox by enticing a victim to visit a crafted HTML page. The flaw is an out-of-bounds read and write (CWE-125) rated High severity by Chromium with a CVSS 8.8, and no public exploit identified at time of analysis, though V8 memory-corruption issues historically attract exploit development. | HIGH | 8.8 | 0.1% | 119 |
KEV
PoC
|
| CVE-2026-3910 | Chrome's V8 JavaScript engine contains an inappropriate implementation (CVE-2026-3910, CVSS 8.8) that allows remote attackers to execute arbitrary code within the browser sandbox via crafted HTML pages. KEV-listed with public PoC, this V8 vulnerability affects all Chromium-based browsers and enables drive-by exploitation through any web page containing malicious JavaScript. | HIGH | 8.8 | 0.1% | 119 |
KEV
PoC
|
| CVE-2026-3909 | Google Chrome's Skia graphics library contains an out-of-bounds write (CVE-2026-3909, CVSS 8.8) enabling remote attackers to perform memory corruption through crafted HTML pages. KEV-listed with public PoC and patches available, this vulnerability in the core graphics rendering engine affects all Chromium-based browsers. | HIGH | 8.8 | 0.1% | 119 |
KEV
PoC
|
| CVE-2026-5281 | Remote code execution in Google Chrome prior to version 146.0.7680.178 via a use-after-free vulnerability in the Dawn graphics component allows attackers who have already compromised the renderer process to execute arbitrary code through a crafted HTML page. The vulnerability requires prior renderer compromise but results in full code execution with high severity per Chromium's security classification. | HIGH | 8.8 | 0.0% | 119 |
KEV
PoC
|
| CVE-2026-2441 | Google Chrome's CSS engine contains a use-after-free vulnerability (CVE-2026-2441, CVSS 8.8) that allows remote attackers to execute arbitrary code within the browser sandbox through crafted HTML pages. KEV-listed with public PoC, this vulnerability enables drive-by exploitation when users visit malicious or compromised websites. | HIGH | 8.8 | 0.1% | 114 |
KEV
PoC
|
| CVE-2025-48595 | Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) stems from an integer overflow (CWE-190) that can be triggered without user interaction to achieve code execution. With CVSS 8.4 and SSVC technical impact rated 'total,' a local attacker on the device can elevate privileges across security boundaries without additional execution rights. No public exploit identified at time of analysis and SSVC reports exploitation status as 'none.' | HIGH | 8.4 | 0.0% | 112 |
KEV
PoC
No patch
|
| CVE-2025-10585 | Google Chrome V8 JavaScript engine contains a type confusion vulnerability enabling heap corruption through crafted HTML pages, exploited in the wild in June 2025. | CRITICAL | 9.8 | 0.7% | 100 |
KEV
|
| CVE-2025-13223 | Google Chrome V8 contains a type confusion vulnerability in the JavaScript engine, the second V8 type confusion zero-day in 2025, exploited in targeted attacks. | HIGH | 8.8 | 2.5% | 97 |
KEV
|
| CVE-2025-48572 | Android contains a missing authentication vulnerability (CVE-2025-48572, CVSS 7.8) in multiple locations that allows background activity launches through a permissions bypass, enabling local privilege escalation without user interaction. KEV-listed, this vulnerability enables malicious apps to perform privileged operations silently in the background, bypassing Android's activity launch restrictions. | HIGH | 7.8 | 0.2% | 89 |
KEV
No patch
|
| CVE-2025-12139 | The File Manager for Google Drive - Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 22.0% and no vendor patch available. | HIGH | 7.5 | 22.0% | 80 |
PoC
No patch
|
| CVE-2025-48633 | CVE-2025-48633 is a security vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed). Vendor patch is available. | MEDIUM | 5.5 | 0.2% | 78 |
KEV
|
| CVE-2025-11307 | The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 7.0% | 71 |
PoC
No patch
|
| CVE-2025-59834 | ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 1.2% | 70 |
PoC
|