Vulnerabilities in Brave
10 resultsCVE-2021-21323MEDIUMRegression in DNS leakage from Tor windowsEPSS 1.9%CVE-2025-7710CRITICALBrave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to AdministratorEPSS 0.6%CVE-2024-37406HIGHIn Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, which may lead to domEPSS 0.4%CVE-2025-23086MEDIUMOn most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector EPSS 0.4%CVE-2023-51534MEDIUMWordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-30453MEDIUMWordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.3%CVE-2024-35655MEDIUMWordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48980MEDIUMIn Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu itemEPSS 0.3%CVE-2025-68508MEDIUMWordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-43337MEDIUMWordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%