Export limit exceeded: 425871 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425871 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124906 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124907 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124909 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 4.3 Medium |
| Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124910 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 6.1 Medium |
| Mitigation bypass in the WebExtensions component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124912 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 6.1 Medium |
| Spoofing issue in the DOM: Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124913 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 6.1 Medium |
| Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124914 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 6.1 Medium |
| Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124915 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124917 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 9.6 Critical |
| Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124918 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124919 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124922 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Use-after-free in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124924 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124926 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124929 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 4.3 Medium |
| Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124930 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 4.3 Medium |
| Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124931 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 6.1 Medium |
| Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124932 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 8.8 High |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-124933 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-11-14 | 6.1 Medium |
| Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. | ||||
| CVE-2026-88822 | 1 Openssl | 1 Openssl | 2026-11-14 | N/A |
| Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets. Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic. CWE: CWE-457 (Use of Uninitialized Variable) Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake. This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module. | ||||