Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates
16,156 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.
CVE-2026-118329
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:12.181Z. Updated 2026-10-29T03:56:15.712Z.
CVE-2026-118322
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:11.846Z. Updated 2026-10-29T14:14:50.833Z.
CVE-2026-118320
Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:11.628Z. Updated 2026-10-29T03:56:17.159Z.
CVE-2026-118317
Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:11.418Z. Updated 2026-10-29T03:56:18.874Z.
CVE-2026-118305
Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:11.199Z. Updated 2026-10-28T17:37:52.934Z.
CVE-2026-118339
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:10.980Z. Updated 2026-10-29T03:56:20.340Z.
CVE-2026-118350
Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:10.539Z. Updated 2026-10-29T03:56:21.913Z.
CVE-2026-118318
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:10.313Z. Updated 2026-10-29T14:14:05.516Z.
CVE-2026-118357
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:10.088Z. Updated 2026-10-29T03:56:23.359Z.
CVE-2026-118344
Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:09.848Z. Updated 2026-10-29T03:56:24.832Z.
CVE-2026-118348
Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:09.516Z. Updated 2026-10-29T03:56:31.370Z.
CVE-2026-118331
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:09.097Z. Updated 2026-10-29T03:56:27.737Z.
CVE-2026-118306
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T23:03:08.662Z. Updated 2026-10-28T17:37:53.096Z.
WebSub: Reflected script execution through intent-verification challenges
WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME s…
Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:40:54.912Z. Updated 2026-10-28T16:12:40.129Z.
Nuxt Ollama: public runtime configuration discloses the configured cloud API key
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__N…
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:36:09.750Z. Updated 2026-10-27T22:36:09.750Z.
GRR vulnerable to Arbitrary File Read and Deletion
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file di…
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:34:47.670Z. Updated 2026-10-27T22:34:47.670Z.
GRR vulnerable to Remote Code Execution Via PHP Code Injection
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The admin…
Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:32:12.589Z. Updated 2026-10-27T22:32:12.589Z.
Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `req…
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:30:09.563Z. Updated 2026-10-28T16:12:46.274Z.
GRR has a Reflected XSS issue
GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser…
Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:26:14.705Z. Updated 2026-10-27T22:26:14.705Z.
CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products
The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.
Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-10-27T22:20:43.242Z. Updated 2026-10-27T22:20:43.242Z.