Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates
5,813 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.
CVE-2026-5869
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:43.915Z. Updated 2026-04-14T12:52:09.160Z.
CVE-2026-5868
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:43.524Z. Updated 2026-04-13T13:05:27.393Z.
CVE-2026-5867
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:43.173Z. Updated 2026-05-26T18:12:58.353Z.
CVE-2026-5866
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:42.797Z. Updated 2026-04-10T03:55:47.563Z.
CVE-2026-5865
Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:42.400Z. Updated 2026-05-26T18:06:50.085Z.
CVE-2026-5864
Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:41.982Z. Updated 2026-04-14T12:51:29.954Z.
CVE-2026-5863
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:41.585Z. Updated 2026-05-10T20:06:39.048Z.
CVE-2026-5862
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:41.201Z. Updated 2026-04-13T13:18:17.045Z.
CVE-2026-5861
Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:40.803Z. Updated 2026-04-13T13:18:33.631Z.
CVE-2026-5860
Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:40.379Z. Updated 2026-05-26T18:11:23.894Z.
CVE-2026-5859
Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:39.849Z. Updated 2026-04-13T13:19:21.572Z.
CVE-2026-5858
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:20:38.772Z. Updated 2026-04-13T13:19:41.280Z.
code-projects Easy Blog Site update.php cross site scripting
A security vulnerability has been detected in code-projects Easy Blog Site 1.0. This affects an unknown function of the file /posts/update.php. The manipulation of the argument postTitle leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:15:17.524Z. Updated 2026-04-09T19:40:42.658Z.
monetr: Protected Transactions Deletable via PUT
monetr is a budgeting application focused on planning for recurring expenses. Prior to 1.12.3, a transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transaction…
Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T21:02:56.280Z. Updated 2026-04-10T20:55:42.904Z.
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output…
Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T20:58:22.979Z. Updated 2026-04-09T13:42:36.997Z.
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T20:49:41.967Z. Updated 2026-09-10T12:04:47.954Z.
PraisonAI has a Template Injection in Agent Tool Definitions
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) that process file content using template rendering. When user input from agent.start() is passed directly into these tools without escaping, template expressions in the input are exe…
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T20:46:59.018Z. Updated 2026-04-09T13:49:10.631Z.
PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary Java…
Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T20:45:30.928Z. Updated 2026-04-09T16:16:51.923Z.
PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The create_a2u_routes() function registers the following endpoints with NO authentication checks: /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /…
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T20:44:24.276Z. Updated 2026-04-10T20:54:03.584Z.
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted __builtins__ dict and an AST-based blocklist. The AST blocklist embedded inside the subprocess wrapper (block…
Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-04-08T20:41:56.680Z. Updated 2026-04-09T20:21:16.297Z.