| 0 |
| url |
VCID-2k46-261h-y3bd |
| vulnerability_id |
VCID-2k46-261h-y3bd |
| summary |
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-5873 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00038 |
| scoring_system |
epss |
| scoring_elements |
0.11334 |
| published_at |
2026-04-13T12:55:00Z |
|
| 1 |
| value |
0.00038 |
| scoring_system |
epss |
| scoring_elements |
0.11391 |
| published_at |
2026-04-09T12:55:00Z |
|
| 2 |
| value |
0.00038 |
| scoring_system |
epss |
| scoring_elements |
0.11397 |
| published_at |
2026-04-11T12:55:00Z |
|
| 3 |
| value |
0.00038 |
| scoring_system |
epss |
| scoring_elements |
0.11363 |
| published_at |
2026-04-12T12:55:00Z |
|
| 4 |
| value |
0.00102 |
| scoring_system |
epss |
| scoring_elements |
0.2778 |
| published_at |
2026-04-26T12:55:00Z |
|
| 5 |
| value |
0.00102 |
| scoring_system |
epss |
| scoring_elements |
0.28039 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.00102 |
| scoring_system |
epss |
| scoring_elements |
0.28022 |
| published_at |
2026-04-18T12:55:00Z |
|
| 7 |
| value |
0.00102 |
| scoring_system |
epss |
| scoring_elements |
0.27974 |
| published_at |
2026-04-21T12:55:00Z |
|
| 8 |
| value |
0.00102 |
| scoring_system |
epss |
| scoring_elements |
0.27892 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-5873 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-5873
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2k46-261h-y3bd |
|
| 1 |
| url |
VCID-3c8j-6wcw-83ax |
| vulnerability_id |
VCID-3c8j-6wcw-83ax |
| summary |
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6305 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00025 |
| scoring_system |
epss |
| scoring_elements |
0.06673 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00029 |
| scoring_system |
epss |
| scoring_elements |
0.08135 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.09061 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.0907 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.09114 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6305 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6305
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3c8j-6wcw-83ax |
|
| 2 |
| url |
VCID-47az-428z-bkar |
| vulnerability_id |
VCID-47az-428z-bkar |
| summary |
Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6304 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.05984 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.1042 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.11509 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.11595 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.11548 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6304 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6304
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-47az-428z-bkar |
|
| 3 |
| url |
VCID-7x3z-8d6t-vfen |
| vulnerability_id |
VCID-7x3z-8d6t-vfen |
| summary |
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6362 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.04336 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.04299 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.04316 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10232 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00051 |
| scoring_system |
epss |
| scoring_elements |
0.15637 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6362 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6362
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7x3z-8d6t-vfen |
|
| 4 |
| url |
VCID-8j9g-6zs1-13am |
| vulnerability_id |
VCID-8j9g-6zs1-13am |
| summary |
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6314 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.05984 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00026 |
| scoring_system |
epss |
| scoring_elements |
0.07258 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.1056 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.10611 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6314 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6314
|
| risk_score |
3.6 |
| exploitability |
0.5 |
| weighted_severity |
7.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8j9g-6zs1-13am |
|
| 5 |
| url |
VCID-97y1-b8j2-xfb5 |
| vulnerability_id |
VCID-97y1-b8j2-xfb5 |
| summary |
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6298 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01143 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01137 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
8e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00692 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
9e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00924 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6298 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6298
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-97y1-b8j2-xfb5 |
|
| 6 |
| url |
VCID-9amk-6z38-qbb1 |
| vulnerability_id |
VCID-9amk-6z38-qbb1 |
| summary |
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6313 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01093 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01089 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
8e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00672 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
9e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00886 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6313 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6313
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9amk-6z38-qbb1 |
|
| 7 |
| url |
VCID-dzf3-492x-budu |
| vulnerability_id |
VCID-dzf3-492x-budu |
| summary |
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6303 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00048 |
| scoring_system |
epss |
| scoring_elements |
0.14708 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00048 |
| scoring_system |
epss |
| scoring_elements |
0.14679 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00048 |
| scoring_system |
epss |
| scoring_elements |
0.1471 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.2357 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00128 |
| scoring_system |
epss |
| scoring_elements |
0.3218 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6303 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6303
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dzf3-492x-budu |
|
| 8 |
| url |
VCID-erxp-a8pr-zyff |
| vulnerability_id |
VCID-erxp-a8pr-zyff |
| summary |
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6296 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00021 |
| scoring_system |
epss |
| scoring_elements |
0.05735 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00025 |
| scoring_system |
epss |
| scoring_elements |
0.06911 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00027 |
| scoring_system |
epss |
| scoring_elements |
0.07673 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00027 |
| scoring_system |
epss |
| scoring_elements |
0.07751 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00027 |
| scoring_system |
epss |
| scoring_elements |
0.07695 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6296 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6296
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-erxp-a8pr-zyff |
|
| 9 |
| url |
VCID-fk6m-8k4f-hyhz |
| vulnerability_id |
VCID-fk6m-8k4f-hyhz |
| summary |
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6302 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.07722 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00044 |
| scoring_system |
epss |
| scoring_elements |
0.13367 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00048 |
| scoring_system |
epss |
| scoring_elements |
0.14708 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00048 |
| scoring_system |
epss |
| scoring_elements |
0.14679 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00048 |
| scoring_system |
epss |
| scoring_elements |
0.1471 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6302 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6302
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fk6m-8k4f-hyhz |
|
| 10 |
| url |
VCID-hyew-s4ya-43bv |
| vulnerability_id |
VCID-hyew-s4ya-43bv |
| summary |
Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6361 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00012 |
| scoring_system |
epss |
| scoring_elements |
0.01686 |
| published_at |
2026-04-18T12:55:00Z |
|
| 1 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03087 |
| published_at |
2026-04-16T12:55:00Z |
|
| 2 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03611 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03599 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00016 |
| scoring_system |
epss |
| scoring_elements |
0.03606 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6361 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6361
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hyew-s4ya-43bv |
|
| 11 |
| url |
VCID-jd9x-rsee-ekfk |
| vulnerability_id |
VCID-jd9x-rsee-ekfk |
| summary |
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6308 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09789 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09773 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09819 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.2357 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26209 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6308 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6308
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jd9x-rsee-ekfk |
|
| 12 |
| url |
VCID-jku3-pwsy-bufq |
| vulnerability_id |
VCID-jku3-pwsy-bufq |
| summary |
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6311 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00023 |
| scoring_system |
epss |
| scoring_elements |
0.06063 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00027 |
| scoring_system |
epss |
| scoring_elements |
0.07413 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00029 |
| scoring_system |
epss |
| scoring_elements |
0.08215 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00029 |
| scoring_system |
epss |
| scoring_elements |
0.08277 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00029 |
| scoring_system |
epss |
| scoring_elements |
0.08254 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6311 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6311
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jku3-pwsy-bufq |
|
| 13 |
| url |
VCID-jqs4-fgj9-63g7 |
| vulnerability_id |
VCID-jqs4-fgj9-63g7 |
| summary |
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6297 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01076 |
| published_at |
2026-04-18T12:55:00Z |
|
| 1 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01352 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.0134 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00011 |
| scoring_system |
epss |
| scoring_elements |
0.01348 |
| published_at |
2026-04-24T12:55:00Z |
|
| 4 |
| value |
6e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00355 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6297 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6297
|
| risk_score |
3.8 |
| exploitability |
0.5 |
| weighted_severity |
7.5 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jqs4-fgj9-63g7 |
|
| 14 |
|
| 15 |
| url |
VCID-mjv9-578z-3kej |
| vulnerability_id |
VCID-mjv9-578z-3kej |
| summary |
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6312 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01036 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.0001 |
| scoring_system |
epss |
| scoring_elements |
0.01033 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
8e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00645 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
9e-05 |
| scoring_system |
epss |
| scoring_elements |
0.00848 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6312 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6312
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mjv9-578z-3kej |
|
| 16 |
| url |
VCID-mp8f-94vu-jyf9 |
| vulnerability_id |
VCID-mp8f-94vu-jyf9 |
| summary |
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6301 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.0783 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00033 |
| scoring_system |
epss |
| scoring_elements |
0.09433 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.10547 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.10563 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6301 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6301
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mp8f-94vu-jyf9 |
|
| 17 |
| url |
VCID-my86-8n81-y3hd |
| vulnerability_id |
VCID-my86-8n81-y3hd |
| summary |
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6307 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00028 |
| scoring_system |
epss |
| scoring_elements |
0.0783 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00033 |
| scoring_system |
epss |
| scoring_elements |
0.09433 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.10547 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.10563 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6307 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6307
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-my86-8n81-y3hd |
|
| 18 |
| url |
VCID-ndkj-5v64-cfa9 |
| vulnerability_id |
VCID-ndkj-5v64-cfa9 |
| summary |
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6309 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.05984 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.1042 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.11509 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.11595 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.11548 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6309 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6309
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ndkj-5v64-cfa9 |
|
| 19 |
| url |
VCID-q17c-ud54-5ydd |
| vulnerability_id |
VCID-q17c-ud54-5ydd |
| summary |
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6306 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.09061 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.0907 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00031 |
| scoring_system |
epss |
| scoring_elements |
0.09114 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.00071 |
| scoring_system |
epss |
| scoring_elements |
0.21771 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24477 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6306 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6306
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q17c-ud54-5ydd |
|
| 20 |
| url |
VCID-qrwz-k5dg-27b2 |
| vulnerability_id |
VCID-qrwz-k5dg-27b2 |
| summary |
Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. (Chromium security severity: Medium) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6364 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.04308 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.04275 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00017 |
| scoring_system |
epss |
| scoring_elements |
0.04287 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.00026 |
| scoring_system |
epss |
| scoring_elements |
0.07056 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00035 |
| scoring_system |
epss |
| scoring_elements |
0.10232 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6364 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6364
|
| risk_score |
1.9 |
| exploitability |
0.5 |
| weighted_severity |
3.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qrwz-k5dg-27b2 |
|
| 21 |
| url |
VCID-thk2-w3k4-jfep |
| vulnerability_id |
VCID-thk2-w3k4-jfep |
| summary |
Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6360 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.05834 |
| published_at |
2026-04-18T12:55:00Z |
|
| 1 |
| value |
0.00024 |
| scoring_system |
epss |
| scoring_elements |
0.06478 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00024 |
| scoring_system |
epss |
| scoring_elements |
0.06439 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00024 |
| scoring_system |
epss |
| scoring_elements |
0.06455 |
| published_at |
2026-04-24T12:55:00Z |
|
| 4 |
| value |
0.00027 |
| scoring_system |
epss |
| scoring_elements |
0.07564 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6360 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6360
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-thk2-w3k4-jfep |
|
| 22 |
| url |
VCID-vxex-hv2g-gbhk |
| vulnerability_id |
VCID-vxex-hv2g-gbhk |
| summary |
Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-5886 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00025 |
| scoring_system |
epss |
| scoring_elements |
0.07086 |
| published_at |
2026-04-12T12:55:00Z |
|
| 1 |
| value |
0.00025 |
| scoring_system |
epss |
| scoring_elements |
0.07097 |
| published_at |
2026-04-11T12:55:00Z |
|
| 2 |
| value |
0.00025 |
| scoring_system |
epss |
| scoring_elements |
0.07076 |
| published_at |
2026-04-13T12:55:00Z |
|
| 3 |
| value |
0.0003 |
| scoring_system |
epss |
| scoring_elements |
0.08625 |
| published_at |
2026-04-26T12:55:00Z |
|
| 4 |
| value |
0.0003 |
| scoring_system |
epss |
| scoring_elements |
0.08518 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.0003 |
| scoring_system |
epss |
| scoring_elements |
0.08505 |
| published_at |
2026-04-18T12:55:00Z |
|
| 6 |
| value |
0.0003 |
| scoring_system |
epss |
| scoring_elements |
0.08657 |
| published_at |
2026-04-21T12:55:00Z |
|
| 7 |
| value |
0.0003 |
| scoring_system |
epss |
| scoring_elements |
0.0867 |
| published_at |
2026-04-24T12:55:00Z |
|
| 8 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09357 |
| published_at |
2026-04-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-5886 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://issues.chromium.org/issues/485397283 |
| reference_id |
485397283 |
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:38:06Z/ |
|
|
| url |
https://issues.chromium.org/issues/485397283 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-5886
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vxex-hv2g-gbhk |
|
| 23 |
| url |
VCID-x1xm-1qpa-u7c1 |
| vulnerability_id |
VCID-x1xm-1qpa-u7c1 |
| summary |
Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6359 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00063 |
| scoring_system |
epss |
| scoring_elements |
0.19503 |
| published_at |
2026-04-18T12:55:00Z |
|
| 1 |
| value |
0.00068 |
| scoring_system |
epss |
| scoring_elements |
0.20811 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00068 |
| scoring_system |
epss |
| scoring_elements |
0.20825 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
0.00068 |
| scoring_system |
epss |
| scoring_elements |
0.20945 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00068 |
| scoring_system |
epss |
| scoring_elements |
0.20814 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6359 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6359
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-x1xm-1qpa-u7c1 |
|
| 24 |
| url |
VCID-y6r7-wj7c-p3bn |
| vulnerability_id |
VCID-y6r7-wj7c-p3bn |
| summary |
Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-5891 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09357 |
| published_at |
2026-04-09T12:55:00Z |
|
| 1 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09366 |
| published_at |
2026-04-11T12:55:00Z |
|
| 2 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09338 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09325 |
| published_at |
2026-04-13T12:55:00Z |
|
| 4 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.1672 |
| published_at |
2026-04-26T12:55:00Z |
|
| 5 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16794 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16799 |
| published_at |
2026-04-18T12:55:00Z |
|
| 7 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16831 |
| published_at |
2026-04-21T12:55:00Z |
|
| 8 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.16737 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-5891 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-5891
|
| risk_score |
1.9 |
| exploitability |
0.5 |
| weighted_severity |
3.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y6r7-wj7c-p3bn |
|
| 25 |
| url |
VCID-ywwf-hc75-nbdm |
| vulnerability_id |
VCID-ywwf-hc75-nbdm |
| summary |
Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6316 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.2357 |
| published_at |
2026-04-16T12:55:00Z |
|
| 1 |
| value |
0.00128 |
| scoring_system |
epss |
| scoring_elements |
0.3218 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00139 |
| scoring_system |
epss |
| scoring_elements |
0.33588 |
| published_at |
2026-04-26T12:55:00Z |
|
| 3 |
| value |
0.00139 |
| scoring_system |
epss |
| scoring_elements |
0.33978 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00139 |
| scoring_system |
epss |
| scoring_elements |
0.33608 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-6316 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-6316
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ywwf-hc75-nbdm |
|