BR
Vendor
Brave
34
CVEs
0
On KEV
1
New 30D
Products
BR7.5
Brave
Brave
18 CVEs0 on KEV1 new
BR6.5
Browser
Brave
5 CVEs0 on KEV0 new
BP5.4
Brave Popup Builder
Brave
3 CVEs0 on KEV0 new
BB7.5
Brave Browser
Brave
2 CVEs0 on KEV0 new
DB6.5
Desktop Browser
Brave
2 CVEs0 on KEV0 new
AD6.1
Adblock-lists
Brave
1 CVEs0 on KEV0 new
AB7.5
Android Browser
Brave
1 CVEs0 on KEV0 new
BC9.8
Brave Conversion Engine (PRO)
Brave
1 CVEs0 on KEV0 new
BC4.8
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
Brave
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-48202 New | BR Brave Brave | 5.3 | Oct 29 | WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability |
| CVE-2025-68508 | BR Brave Brave | 5.3 | Dec 24 | WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability |
| CVE-2025-48980 | DB Desktop Browser Brave | 6.5 | Oct 30 | In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie… |
| CVE-2025-7710 | BC Brave Conversion Engine (PRO) Brave | 9.8 | Aug 2 | Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator |
| CVE-2025-23086 | DB Desktop Browser Brave | 6.1 | Jan 21 | On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to… |
| CVE-2024-37406 | AB Android Browser Brave | 7.5 | Sep 18 | In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domain confusion |
| CVE-2024-43337 | BP Brave Popup Builder Brave | 4.3 | Aug 26 | WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-35655 | BR Brave Brave | 4.8 | Jun 4 | WordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-30453 | BP Brave Popup Builder Brave | 5.4 | Mar 29 | WordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability |
| CVE-2023-51534 | BC Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content Brave | 4.8 | Feb 1 | WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-52263 | BR Browser Brave | 6.1 | Dec 30 | Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect |
| CVE-2023-28364 | BR Browser Brave | 6.1 | Jun 30 | An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned URLs automatically without showing the… |
| CVE-2023-28360 | BR Brave Brave | 4.3 | May 11 | An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check… |
| CVE-2023-22798 | AD Adblock-lists Brave | 6.1 | Feb 9 | Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websites like Facebook in which the redirect… |
| CVE-2022-47932 | BR Brave Brave | 6.5 | Dec 24 | Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL |
| CVE-2022-47933 | BR Brave Brave | 6.5 | Dec 24 | Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme |
| CVE-2022-47934 | BR Brave Brave | 6.5 | Dec 24 | Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL |
| CVE-2022-30334 | BR Brave Brave | 5.3 | May 7 | Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers |
| CVE-2021-45884 | BR Brave Brave | 7.5 | Dec 27 | In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued… |
| CVE-2021-22929 | BR Brave Brave | 6.1 | Aug 31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in… |
| CVE-2021-22917 | BR Browser Brave | 6.5 | Jul 12 | Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was… |
| CVE-2021-22916 | BR Brave Brave | 5.9 | Jul 12 | In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that… |
| CVE-2021-21323 | BR Brave Brave | 5.3 | Feb 23 | Brave is an open source web browser with a focus on privacy and security |
| CVE-2020-8276 | BR Brave Brave | 5.5 | Nov 9 | The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window,… |
| CVE-2018-1000815 | BR Brave Brave | 4.3 | Dec 20 | Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in… |
| CVE-2018-10799 | BR Brave Brave | 6.5 | May 8 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux) |
| CVE-2018-10798 | BR Brave Brave | 6.5 | May 8 | A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux) |
| CVE-2017-18256 | BB Brave Browser Brave | 6.5 | Apr 4 | Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code, because window dialogs are… |
| CVE-2016-10718 | BB Brave Browser Brave | 7.5 | Apr 4 | Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service |
| CVE-2017-1000461 | BR Browser Brave | 4.7 | Jan 3 | Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component, resulting in a… |
| CVE-2017-8459 | BR Brave Brave | 5.3 | May 3 | Brave 0.12.4 has a Status Bar Obfuscation issue in which a redirection target is shown in a possibly unexpected way |
| CVE-2017-8458 | BR Brave Brave | 6.5 | May 3 | Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://safe.example.com@unsafe.example.com/ is displayed without a clear UI indication that it is not a… |
| CVE-2016-9473 | BR Browser Brave | 4.7 | Mar 28 | Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious… |