Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-109713 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109711 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109710 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109706 | 5.4 medium | 0.00% | no CPE yet | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-100822 | 5.4 medium | 0.00% | mozilla, firefox, thunderbird | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 13 Oct |
| CVE-2026-6767 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | Mon 26 Oct |
| CVE-2026-6775 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6778 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6783 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-42177 | 5.3 medium | 0.00% | no CPE yet | linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1. | Mon 26 Oct |
| CVE-2026-12300 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12301 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12306 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12307 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12308 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-6779 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Mon 26 Oct |
| CVE-2026-6777 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | Sun 25 Oct |
| CVE-2026-8391 | 5.3 medium | 0.00% | mozilla, firefox | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | Sun 25 Oct |
| CVE-2026-12329 | 5.3 medium | 0.00% | mozilla, firefox, thunderbird | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. | Sun 25 Oct |
| CVE-2026-14906 | 5.3 medium | 0.00% | mozilla, firefox_mobile | Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4. | Sat 24 Oct |
| CVE-2026-44659 | 4.7 medium | 0.00% | no CPE yet | Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector. This vulnerability is fixed in 1.19.12b. | Mon 26 Oct |
| CVE-2026-12311 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-12313 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. | Mon 26 Oct |
| CVE-2026-100821 | 4.7 medium | 0.00% | mozilla, firefox, thunderbird | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2026-12303 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-12320 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | Mon 26 Oct |
| CVE-2026-53900 | 4.3 medium | 0.00% | mozilla, firefox_mobile | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0. | Mon 26 Oct |
| CVE-2025-6425 | 4.3 medium | 0.00% | mozilla, firefox | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | 23 Oct |
| CVE-2026-100799 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100802 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 19 Oct |
| CVE-2026-100806 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 19 Oct |
| CVE-2026-109777 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109771 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109769 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109767 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109751 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109742 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-100766 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2026-109776 | 4.2 medium | 0.00% | no CPE yet | Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 15 Oct |
| CVE-2026-109779 | 4.2 medium | 0.00% | no CPE yet | Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109765 | 4.2 medium | 0.00% | no CPE yet | Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109719 | 4.2 medium | 0.00% | no CPE yet | Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2025-13015 | 3.4 low | 0.00% | mozilla, firefox | Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. | 23 Oct |
| CVE-2026-44658 | 2.4 low | 0.00% | no CPE yet | Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b. | Mon 26 Oct |
| CVE-2026-109763 | unscored | 0.00% | no CPE yet | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 h ago |
| CVE-2026-113399 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | Thu 29 Oct |
| CVE-2026-74950 | unscored | 0.00% | mozilla, firefox, thunderbird | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | Wed 28 Oct |
| CVE-2026-118004 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118003 | unscored | 0.00% | no CPE yet | Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118002 | unscored | 0.00% | no CPE yet | Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
Download these 613 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.