CVE Feed

    Dashboard / CVE

    9.6
    Critical

    CVE-2026-100818

    Last Modified: 5 Oct 2026

    Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    5.4
    Medium

    CVE-2026-100817

    Last Modified: 7 Oct 2026

    Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    8.1
    High

    CVE-2026-100816

    Last Modified: 5 Oct 2026

    Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100815

    Last Modified: 5 Oct 2026

    Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100814

    Last Modified: 5 Oct 2026

    Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100813

    Last Modified: 5 Oct 2026

    Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    6.5
    Medium

    CVE-2026-100812

    Last Modified: 5 Oct 2026

    Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    9.8
    Critical

    CVE-2026-100810

    Last Modified: 5 Oct 2026

    Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100811

    Last Modified: 5 Oct 2026

    Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.1
    High

    CVE-2026-100809

    Last Modified: 5 Oct 2026

    Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100808

    Last Modified: 5 Oct 2026

    Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100807

    Last Modified: 19 Oct 2026

    Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    4.3
    Medium

    CVE-2026-100806

    Last Modified: 19 Oct 2026

    Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    7.5
    High

    CVE-2026-100805

    Last Modified: 19 Oct 2026

    Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    8.1
    High

    CVE-2026-100803

    Last Modified: 19 Oct 2026

    Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100804

    Last Modified: 19 Oct 2026

    Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    4.3
    Medium

    CVE-2026-100802

    Last Modified: 19 Oct 2026

    Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100801

    Last Modified: 27 Oct 2026

    Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100800

    Last Modified: 19 Oct 2026

    Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    4.3
    Medium

    CVE-2026-100799

    Last Modified: 19 Oct 2026

    Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    8.1
    High

    CVE-2026-100798

    Last Modified: 19 Oct 2026

    Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100796

    Last Modified: 19 Oct 2026

    Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100797

    Last Modified: 19 Oct 2026

    Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    6.5
    Medium

    CVE-2026-100795

    Last Modified: 19 Oct 2026

    Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    4.3
    Medium

    CVE-2026-96869

    Last Modified: 5 Oct 2026

    Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100794

    Last Modified: 19 Oct 2026

    Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    6.5
    Medium

    CVE-2026-100793

    Last Modified: 19 Oct 2026

    JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

    Published: 29 Sept 2026
    7.1
    High

    CVE-2026-100792

    Last Modified: 19 Oct 2026

    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100790

    Last Modified: 19 Oct 2026

    Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100791

    Last Modified: 19 Oct 2026

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.8
    Critical

    CVE-2026-100788

    Last Modified: 19 Oct 2026

    Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100789

    Last Modified: 19 Oct 2026

    Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100787

    Last Modified: 5 Oct 2026

    Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100786

    Last Modified: 5 Oct 2026

    Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100785

    Last Modified: 5 Oct 2026

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100784

    Last Modified: 5 Oct 2026

    Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    4.3
    Medium

    CVE-2026-100783

    Last Modified: 5 Oct 2026

    Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100782

    Last Modified: 5 Oct 2026

    Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100781

    Last Modified: 5 Oct 2026

    Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100780

    Last Modified: 5 Oct 2026

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100779

    Last Modified: 5 Oct 2026

    Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100778

    Last Modified: 5 Oct 2026

    Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100777

    Last Modified: 5 Oct 2026

    Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100776

    Last Modified: 6 Oct 2026

    Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100775

    Last Modified: 6 Oct 2026

    Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100774

    Last Modified: 6 Oct 2026

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100773

    Last Modified: 6 Oct 2026

    Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.8
    High

    CVE-2026-100772

    Last Modified: 6 Oct 2026

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    8.1
    High

    CVE-2026-100771

    Last Modified: 6 Oct 2026

    Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    9.6
    Critical

    CVE-2026-100770

    Last Modified: 6 Oct 2026

    Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

    Published: 29 Sept 2026
    Items Per Page