CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 11:30 AM ET)

What this means for you

This week: 3,175 CVEs published, 238 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,175; Show in the list
Critical, last 7 days: 238; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product google:chrome. Show all products

3,803 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2011-0609 Known exploited	High 7.8	Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (ak… Assigned by adobe	Mar 15, 2011
CVE-2011-0611 Known exploited	High 8.8	Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe R… Assigned by adobe	Apr 13, 2011
CVE-2011-3389	Medium 4.3	The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode wi… Assigned by mitre	Sep 6, 2011
CVE-2014-0497 Known exploited	High 8.8	Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute ar… Assigned by adobe	Feb 4, 2014
CVE-2016-1646 Known exploited	High 8.8	The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to c… Assigned by Chrome	Mar 29, 2016
CVE-2016-5131	High 8.8	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome	Jul 23, 2016
CVE-2016-5198 Known exploited	High 8.8	V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to… Assigned by Chrome	Jan 19, 2017
CVE-2017-5030 Known exploited	High 8.8	Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a… Assigned by Chrome	Apr 24, 2017
CVE-2015-1239	Medium 6.5	Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a craf…	Oct 18, 2017
CVE-2017-5070 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a craft… Assigned by Chrome	Oct 27, 2017

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.