CVE & CISA-KEV Catalog

413,938 CVEs1,757 actively exploited (KEV)

Want to know which of these are on your machines? Scan your endpoints with the free CVE scanner, 200 endpoints free.

Active:
  • CVE-2026-109434
    Medium
    CVSS 4.3 v3·EPSS 0.3%·No fix yet

    Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.

    Published 2026-10-19

  • CVE-2026-106338
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106316
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106302
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106285
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106276
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106272
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106265
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106251
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106236
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106232
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106229
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106182
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-106179
    Low
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-10-16

  • CVE-2026-109747
    High
    CVSS 7.3 v3·EPSS 0.3%·Fix available

    Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

    Published 2026-10-13

  • CVE-2026-109736
    High
    CVSS 8.1 v3·EPSS 0.3%·Fix available

    Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

    Published 2026-10-13

  • CVE-2026-109346
    High
    CVSS 8.1 v3·EPSS 0.3%·No fix yet

    better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.

    Published 2026-10-12

  • CVE-2026-106380
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    Published 2026-10-06

  • CVE-2026-106368
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    Published 2026-10-06

  • CVE-2026-106337
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    Published 2026-10-06

  • CVE-2026-106317
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

    Published 2026-10-06

  • CVE-2026-106305
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    Published 2026-10-06

  • CVE-2026-106282
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

    Published 2026-10-06

  • CVE-2026-106209
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

    Published 2026-10-06

  • CVE-2026-105043
    Low
    CVSS 3.6 v3·EPSS 0.1%·No fix yet

    MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.

    Published 2026-10-02

  • CVE-2026-87597
    Medium
    CVSS 4.8 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-30

  • CVE-2026-93386
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-30

  • CVE-2026-102314
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    Published 2026-09-29

  • CVE-2026-102312
    Medium
    CVSS 4.3 v3·EPSS 0.2%·Fix available

    UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

    Published 2026-09-29

  • CVE-2026-102305
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

    Published 2026-09-29

  • CVE-2026-100823
    Medium
    CVSS 5.4 v3·EPSS 0.1%·Fix available

    Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.

    Published 2026-09-29

  • CVE-2026-100822
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published 2026-09-29

  • CVE-2026-95363
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95346
    Medium
    CVSS 4.8 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95337
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95323
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95321
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95309
    Low
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95307
    Low
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95305
    Low
    CVSS 4.8 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95294
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95291
    High
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95288
    Low
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-95279
    Low
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-25

  • CVE-2026-94183
    High
    CVSS 7.4 v3·EPSS 0.2%·No fix yet

    Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

    Published 2026-09-23

  • CVE-2026-94181
    High
    CVSS 7.4 v3·EPSS 0.3%·No fix yet

    An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

    Published 2026-09-23

  • CVE-2026-92069
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

    Published 2026-09-15

  • CVE-2026-87653
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-14

  • CVE-2026-87649
    Medium
    CVSS 5.4 v3·EPSS 0.2%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-14

  • CVE-2026-87635
    Medium
    CVSS 5.4 v3·EPSS 0.3%·Fix available

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

    Published 2026-09-14

Free CVE lookup by TridentStack Control, automated patching for Windows, macOS, and Linux fleets. Learn more·Uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog.