Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-109761 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109752 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109749 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109748 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109741 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109738 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109735 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109732 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109729 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109728 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109727 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109726 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109725 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109724 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109718 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109717 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109713 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109711 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109710 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109706 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-100822 | 5.4 medium | 0.00% | mozilla, firefox, thunderbird | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 13 Oct |
| CVE-2026-6767 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-6775 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6778 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6783 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-12300 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12301 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12306 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12307 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12308 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-6779 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6777 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Sun 25 Oct |
| CVE-2026-8391 | 5.3 medium | 0.00% | mozilla, firefox | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | Sun 25 Oct |
| CVE-2026-12329 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. | Sun 25 Oct |
| CVE-2026-57962 | 5.3 medium | 0.00% | mozilla, thunderbird | A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1. | Sun 25 Oct |
| CVE-2026-113868 | 5.3 medium | 0.00% | no CPE yet | When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1. | 22 Oct |
| CVE-2026-12311 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12313 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-100821 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2026-12303 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12320 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2025-6425 | 4.3 medium | 0.00% | mozilla, firefox | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | Fri 23 Oct |
| CVE-2026-100799 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100802 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100806 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 19 Oct |
| CVE-2026-109777 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109771 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109769 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109767 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109751 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
Download these 581 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.