Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-12320 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-53900 | 4.3 medium | 0.00% | mozilla, firefox_mobile | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0. | Mon 26 Oct |
| CVE-2025-6425 | 4.3 medium | 0.00% | mozilla, firefox | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | Fri 23 Oct |
| CVE-2026-100799 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100802 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100806 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 19 Oct |
| CVE-2026-100766 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2025-13015 | 3.4 low | 0.00% | mozilla, firefox | Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. | Fri 23 Oct |
| CVE-2026-113812 | unscored | 0.00% | no CPE yet | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server. LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA. Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident. | 6 h ago |
| CVE-2026-74950 | unscored | 0.00% | mozilla, firefox, thunderbird | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | Wed 28 Oct |
360 of 360 · Previous
Download these 360 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.