Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

4,194 results · page 1 of 84

Oct 27, 2026When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.CVE-2026-118180 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was noCVE-2026-118179 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.CVE-2026-118178 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointCVE-2026-118177 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths.CVE-2026-118176 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into theCVE-2026-118175 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key.CVE-2026-118174 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Frame poisoning in the Layout component.CVE-2026-118027 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Invalid pointer in the JavaScript: GC component.CVE-2026-118026 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Other issue in the SVG component.CVE-2026-118025 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Graphics: Text component.CVE-2026-118024 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to use-after-free in the Graphics: WebRender component.CVE-2026-118023 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to use-after-free in the Disability Access APIs component.CVE-2026-118022 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to use-after-free in the XPCOM component.CVE-2026-118021 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Layout component.CVE-2026-118020 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Race condition, use-after-free in the DOM: File component.CVE-2026-118019 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Spoofing issue in the Downloads component in Firefox for Android.CVE-2026-118018 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the SVG component.CVE-2026-118017 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the DOM: Core & HTML component.CVE-2026-118016 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the DOM: Core & HTML component.CVE-2026-118015 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the JavaScript Engine: JIT component.CVE-2026-118014 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Layout: Images, Video, and HTML Frames component.CVE-2026-118013 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the DOM: Animation component.CVE-2026-118012 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Frame poisoning in the CSS Parsing and Computation component.CVE-2026-118011 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Disability Access APIs component.CVE-2026-118010 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Integer overflow, use-after-free in the Graphics: Text component.CVE-2026-118009 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Privilege escalation in the DOM: Navigation component.CVE-2026-118008 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the JavaScript: GC component.CVE-2026-118007 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Privilege escalation due to use-after-free in the WebRTC: Signaling component.CVE-2026-118006 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the WebRTC: Signaling component.CVE-2026-118005 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Incorrect boundary conditions in the CSS Transitions and Animations component.CVE-2026-118004 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Information disclosure in the Networking: DNS component.CVE-2026-118003 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Information disclosure due to race condition in the Networking component.CVE-2026-118002 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Information disclosure in the Networking: HTTP component.CVE-2026-118000 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Race condition in the IPC component.CVE-2026-117999 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Mitigation bypass in the DOM: Push Subscriptions component.CVE-2026-117998 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to use-after-free in the Widget component.CVE-2026-117997 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Incorrect boundary conditions in the WebRTC component.CVE-2026-117996 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Privilege escalation in the DOM: UI Events & Focus Handling component.CVE-2026-117995 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the JavaScript: GC component.CVE-2026-117994 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Integer overflow in the Graphics: Text component.CVE-2026-117993 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Information disclosure in the CSS Parsing and Computation component.CVE-2026-117992 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Incorrect boundary conditions in the Layout: Text and Fonts component.CVE-2026-117991 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.CVE-2026-117990 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Graphics component.CVE-2026-117989 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.CVE-2026-117988 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Graphics component.CVE-2026-117987 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Use-after-free in the Graphics component.CVE-2026-117986 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Sandbox escape due to use-after-free in the Graphics component.CVE-2026-117985 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 27, 2026Incorrect boundary conditions in the Layout: Scrolling and Overflow component.CVE-2026-117984 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.