CVE Tools
Track your stack

Consumer Software

26,786 CVEs tracked since 1999. In the last 12 months, 6,933, +198% on the 12 before.

Consumer Software by subsector, Oct 2026 so far

Oct 2026 so far: 1,349 CVEs across 6 subsectors. Area is each subsector's share; inside are the products it counted most. Point at one to read it.
  • Browsers74956% · 5 vendors
  • Productivity35026% · 19 vendors
  • Not yet sub-classified176The tagger has not placed these yet

Also: File utilities 49, Media players 15, Games 10.

Month by month

Every monthly snapshot of Consumer Software. A column is the CVEs published that month.

Oct 2021 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Consumer Software CVEs per month
MonthCVEs
2021-1057
2021-11103
2021-12101
2022-0198
2022-0276
2022-03113
2022-0448
2022-05161
2022-06205
2022-0798
2022-08112
2022-09139
2022-1092
2022-1159
2022-12304
2023-01140
2023-0273
2023-030
2023-04107
2023-0560
2023-06143
2023-0771
2023-08101
2023-09159
2023-1066
2023-11134
2023-12283
2024-01133
2024-02113
2024-03119
2024-04142
2024-05349
2024-06252
2024-0757
2024-08155
2024-0980
2024-10136
2024-11356
2024-12233
2025-0164
2025-02109
2025-03141
2025-04140
2025-0588
2025-06382
2025-07353
2025-08185
2025-09140
2025-10104
2025-1192
2025-12346
2026-01147
2026-02220
2026-03305
2026-04227
2026-05729
2026-061401
2026-071021
2026-081033
2026-091308
2026-101349

Vendors

Who shipped the most Consumer Software CVEs in Oct 2026 so far, with their rank across all vendors.

  1. Adobe179#8
  2. Mozilla93#13
  3. Error31123#66
  4. Siyuan-note12#134
  5. Sumatrapdfreader11#147
  6. Devolutions10#154
  7. Rclone10#164

Weaknesses

The weakness classes behind Consumer Software CVEs in Oct 2026 so far.

  1. CWE-416 Use After Free274
  2. CWE-122 Heap Buffer Overflow95
  3. CWE-125 Out-of-bounds Read86
  4. CWE-863 Incorrect Authorization74
  5. CWE-79 XSS48
  6. CWE-862 Missing Authorization46

Latest CVEs

The 15 most recently published vulnerabilities in Consumer Software.

  1. CVE-2026-119272Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)—
  2. CVE-2026-119271Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)—
  3. CVE-2026-119270Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromi...—
  4. CVE-2026-119267Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sever...—
  5. CVE-2026-119268Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se...—
  6. CVE-2026-119269Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)—
  7. CVE-2026-119266Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severi...—
  8. CVE-2026-119264Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security seve...—
  9. CVE-2026-119263Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium...—
  10. CVE-2026-119265Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sev...—
  11. CVE-2026-76031Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)—
  12. CVE-2026-76029Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s...—
  13. CVE-2026-76028Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)—
  14. CVE-2026-76030Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit...—
  15. CVE-2026-119261Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu...—

The record

Busiest month
Jun 2026, 1,401 CVEs
Oct 2026 so far
1,349 CVEs from 65 vendors
Deployment
On-prem, 97%
Monthly snapshots
295 since 1999
All 15 sectors on one map

Is your business exposed to threats like these?

Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.

Request an assessment