Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-109731 | 5.4 medium | 0.00% | no CPE yet | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 19 Oct |
| CVE-2026-109723 | 5.4 medium | 0.00% | no CPE yet | Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 15 Oct |
| CVE-2026-109752 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109741 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109738 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109732 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109729 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109728 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109727 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109726 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109725 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109724 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109718 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109717 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109713 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109711 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109710 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109706 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-100822 | 5.4 medium | 0.00% | mozilla, firefox, thunderbird | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 13 Oct |
| CVE-2026-6767 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-12306 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12307 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12308 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-8391 | 5.3 medium | 0.00% | mozilla, firefox | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | 25 Oct |
| CVE-2026-12329 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. | 25 Oct |
| CVE-2026-12311 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12313 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-100821 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2025-6425 | 4.3 medium | 0.00% | mozilla, firefox | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | 23 Oct |
| CVE-2026-100806 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 19 Oct |
| CVE-2026-109777 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109767 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109751 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109742 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-100766 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2026-109776 | 4.2 medium | 0.00% | no CPE yet | Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 15 Oct |
| CVE-2026-109765 | 4.2 medium | 0.00% | no CPE yet | Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109719 | 4.2 medium | 0.00% | no CPE yet | Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2025-13015 | 3.4 low | 0.00% | mozilla, firefox | Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. | 23 Oct |
| CVE-2026-109763 | unscored | 0.00% | no CPE yet | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | Fri 30 Oct |
| CVE-2026-74950 | unscored | 0.00% | mozilla, firefox, thunderbird | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | Wed 28 Oct |
| CVE-2026-118004 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118003 | unscored | 0.00% | no CPE yet | Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118002 | unscored | 0.00% | no CPE yet | Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118000 | unscored | 0.00% | no CPE yet | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117999 | unscored | 0.00% | no CPE yet | Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117998 | unscored | 0.00% | no CPE yet | Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117997 | unscored | 0.00% | no CPE yet | Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117996 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117995 | unscored | 0.00% | no CPE yet | Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
Download these 436 as CSV · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.