Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-13025 | 7.5 high | 0.00% | mozilla, firefox | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. | 18 Oct |
| CVE-2026-8945 | 7.5 high | 0.00% | mozilla, firefox, firefox_focus | Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151. | 14 Oct |
| CVE-2026-8954 | 7.5 high | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | 14 Oct |
| CVE-2026-8960 | 7.5 high | 0.00% | mozilla, firefox, thunderbird | Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151. | 14 Oct |
| CVE-2026-16404 | 7.4 high | 0.00% | mozilla, firefox_mobile | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-6751 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-6753 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-8090 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2. | Mon 26 Oct |
| CVE-2026-7322 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1. | Mon 26 Oct |
| CVE-2026-7324 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1. | Mon 26 Oct |
| CVE-2026-8390 | 7.3 high | 0.00% | mozilla, firefox | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. | Mon 26 Oct |
| CVE-2026-12318 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12324 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-7323 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1. | Mon 26 Oct |
| CVE-2026-6752 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Sun 25 Oct |
| CVE-2025-10528 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. | Fri 23 Oct |
| CVE-2026-109747 | 7.3 high | 0.00% | no CPE yet | Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 19 Oct |
| CVE-2026-109746 | 7.3 high | 0.00% | no CPE yet | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 19 Oct |
| CVE-2026-8947 | 7.3 high | 0.00% | mozilla, firefox, thunderbird | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | 14 Oct |
| CVE-2025-10527 | 7.1 high | 0.00% | mozilla, firefox, thunderbird | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. | Fri 23 Oct |
| CVE-2026-90648 | 7.1 high | 0.00% | no CPE yet | wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813). | Fri 23 Oct |
| CVE-2026-100792 | 7.1 high | 0.00% | mozilla, firefox, thunderbird | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | 19 Oct |
| CVE-2026-109720 | 7.1 high | 0.00% | no CPE yet | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 19 Oct |
| CVE-2026-109712 | 7.1 high | 0.00% | no CPE yet | Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 16 Oct |
| CVE-2026-81813 | 6.8 medium | 0.00% | no CPE yet | The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected. | 21 Oct |
| CVE-2026-6764 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-12309 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12302 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12319 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12325 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-6755 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6763 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-53899 | 6.5 medium | 0.00% | mozilla, firefox_mobile | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0. | Mon 26 Oct |
| CVE-2026-16397 | 6.5 medium | 0.00% | mozilla, firefox | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-16403 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | Sat 24 Oct |
| CVE-2023-28164 | 6.5 medium | 0.00% | mozilla, firefox, firefox_esr, thunderbird | Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. | Sat 24 Oct |
| CVE-2025-10532 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. | Fri 23 Oct |
| CVE-2023-23601 | 6.5 medium | 0.00% | mozilla, firefox, firefox_esr, thunderbird | Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. | Fri 23 Oct |
| CVE-2026-18809 | 6.5 medium | 0.00% | no CPE yet | Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3. | Fri 23 Oct |
| CVE-2025-10529 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. | Fri 23 Oct |
| CVE-2025-11711 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. | Fri 23 Oct |
| CVE-2025-10290 | 6.5 medium | 0.00% | mozilla, firefox_focus | Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0. | Fri 23 Oct |
| CVE-2026-74951 | 6.5 medium | 0.00% | mozilla, firefox_mobile | Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | 22 Oct |
| CVE-2026-74980 | 6.5 medium | 0.00% | mozilla, firefox_mobile | Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | 22 Oct |
| CVE-2026-113401 | 6.5 medium | 0.00% | no CPE yet | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | 20 Oct |
| CVE-2026-100793 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100795 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2025-10530 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. | 18 Oct |
| CVE-2025-11716 | 6.5 medium | 0.00% | mozilla, firefox, thunderbird | Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144. | 18 Oct |
| CVE-2026-8951 | 6.5 medium | 0.00% | mozilla, firefox | Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151. | 14 Oct |
Download these 613 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.