Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2023-29550 | 8.8 high | 1.0% | mozilla, firefox, firefox_esr, firefox_mobile | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | Sat 24 Oct |
| CVE-2023-29536 | 8.8 high | 1.0% | mozilla, firefox, firefox_esr, firefox_mobile | An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | Fri 23 Oct |
| CVE-2023-29539 | 8.8 high | 1.0% | mozilla, firefox, firefox_esr, firefox_mobile | When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | Fri 23 Oct |
| CVE-2023-25747 | 7.5 high | 1.0% | mozilla, firefox_mobile | A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0. | Fri 23 Oct |
| CVE-2023-29535 | 6.5 medium | 1.0% | mozilla, firefox, firefox_esr, firefox_mobile | Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | Sat 24 Oct |
| CVE-2023-29548 | 6.5 medium | 1.0% | mozilla, firefox, firefox_esr, firefox_mobile | A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | Sat 24 Oct |
| CVE-2026-16373 | 7.5 high | 0.00% | mozilla, firefox_mobile | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-16404 | 7.4 high | 0.00% | mozilla, firefox_mobile | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-53899 | 6.5 medium | 0.00% | mozilla, firefox_mobile | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0. | Mon 26 Oct |
| CVE-2026-74951 | 6.5 medium | 0.00% | mozilla, firefox_mobile | Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | Thu 22 Oct |
| CVE-2026-74980 | 6.5 medium | 0.00% | mozilla, firefox_mobile | Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | Thu 22 Oct |
| CVE-2026-74975 | 5.4 medium | 0.00% | mozilla, firefox_mobile | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | Thu 22 Oct |
| CVE-2026-14906 | 5.3 medium | 0.00% | mozilla, firefox_mobile | Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4. | Sat 24 Oct |
| CVE-2026-53900 | 4.3 medium | 0.00% | mozilla, firefox_mobile | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0. | Mon 26 Oct |
14 of 14
Download these 14 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.