CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product microsoft:edge. Show all products

21 CVEs, showing 1 to 21
CVESeverityTitlePublished
CVE-2026-70341High 8.5Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Assigned by microsoft
Sep 11, 2026
CVE-2026-70331Medium 5.4Microsoft Edge for iOS Spoofing Vulnerability
Assigned by microsoft
Aug 28, 2026
CVE-2026-66310High 7.7Microsoft Edge for Android Information Disclosure Vulnerability
Assigned by microsoft
Aug 3, 2026
CVE-2026-62828Medium 5.4Microsoft Edge for Android (Chromium-based) Tampering Vulnerability
Assigned by microsoft
Jul 28, 2026
CVE-2026-35429Medium 4.3User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.May 12, 2026
CVE-2026-33119Medium 5.4Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Assigned by microsoft
Apr 10, 2026
CVE-2026-26133High 7.1AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.Mar 16, 2026
CVE-2025-62224Low 3.5User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network.Jan 7, 2026
CVE-2024-7971
Known exploited
High 8.8Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Aug 21, 2024
CVE-2023-5217
Known exploited
High 8.8Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Sep 28, 2023
CVE-2022-4135
Known exploited
Critical 9.6Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Assigned by Chrome
Nov 25, 2022
CVE-2021-26411
Known exploited
High 8.8Internet Explorer Memory Corruption Vulnerability
Assigned by microsoft
Mar 11, 2021
CVE-2020-16009
Known exploited
High 8.8Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Assigned by Chrome
Nov 3, 2020
CVE-2020-0878
Known exploited
Medium 4.2Microsoft Browser Memory Corruption Vulnerability
Assigned by microsoft
Sep 11, 2020
CVE-2017-8529Medium 6.5Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's compu…
Assigned by microsoft
Jun 15, 2017
CVE-2017-0037
Known exploited
High 8.1Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allow…
Assigned by microsoft
Feb 26, 2017
CVE-2016-7201
Known exploited
High 8.8The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi…
Assigned by microsoft
Nov 10, 2016
CVE-2016-7200
Known exploited
High 8.8The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi…
Assigned by microsoft
Nov 10, 2016
CVE-2016-3351
Known exploited
Medium 6.5Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
Assigned by microsoft
Sep 14, 2016
CVE-2015-0313
Known exploited
High 7.8Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute ar…
Assigned by adobe
Feb 2, 2015
CVE-2015-0311
Known exploited
High 7.8Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute…
Assigned by adobe
Jan 23, 2015

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.