CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 2:23 PM ET)

What this means for you

This week: 3,191 CVEs published, 245 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,191; Show in the list
Critical, last 7 days: 245; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product microsoft:edge. Show all products

21 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2015-0311 Known exploited	High 7.8	Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute… Assigned by adobe	Jan 23, 2015
CVE-2015-0313 Known exploited	High 7.8	Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute ar… Assigned by adobe	Feb 2, 2015
CVE-2016-3351 Known exploited	Medium 6.5	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." Assigned by microsoft	Sep 14, 2016
CVE-2016-7201 Known exploited	High 8.8	The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi… Assigned by microsoft	Nov 10, 2016
CVE-2016-7200 Known exploited	High 8.8	The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi… Assigned by microsoft	Nov 10, 2016
CVE-2017-0037 Known exploited	High 8.1	Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allow… Assigned by microsoft	Feb 26, 2017
CVE-2017-8529	Medium 6.5	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's compu… Assigned by microsoft	Jun 14, 2017
CVE-2020-0878 Known exploited	Medium 4.2	Microsoft Browser Memory Corruption Vulnerability Assigned by microsoft	Sep 11, 2020
CVE-2020-16009 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 2, 2020
CVE-2021-26411 Known exploited	High 8.8	Internet Explorer Memory Corruption Vulnerability Assigned by microsoft	Mar 11, 2021

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.