Overview 3,664 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
3,664matches
1in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.0%
Outside Waratek scope
12
0.3%
Not applicable
3,651
99.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
3,664
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
3,664
100.0%
split by
peak 589 / year
20001
Not applicable1
High1
not blocked1
No public exploit1
20018
Not applicable8
High6
Low2
not blocked8
No public exploit8
200227
Not applicable27
High16
Medium9
Low2
not blocked27
No public exploit27
200311
Not applicable11
Critical1
High3
Medium4
Low3
not blocked11
No public exploit11
200448
Outside Waratek scope1
Not applicable47
High17
Medium25
Low6
not blocked48
No public exploit48
200582
Not applicable82
High25
Medium35
Low22
not blocked82
No public exploit82
2006109
Not applicable109
High46
Medium50
Low13
not blocked109
No public exploit109
200778
Not applicable78
Critical1
High24
Medium51
Low2
not blocked78
No public exploit78
200891
Not applicable91
High40
Medium48
Low3
not blocked91
No public exploit91
2009116
Outside Waratek scope3
Not applicable113
High64
Medium49
Low3
not blocked116
No public exploit116
2010111
Not applicable111
High55
Medium52
Low4
not blocked111
No public exploit111
2011112
Not applicable112
High62
Medium46
Low4
not blocked112
No public exploit112
2012202
Not applicable202
High120
Medium78
Low4
not blocked202
No public exploit202
2013150
Not applicable150
Critical6
High88
Medium55
Low1
not blocked150
No public exploit150
2014115
Outside Waratek scope3
Not applicable112
Critical7
High53
Medium52
Low3
not blocked115
No public exploit115
2015181
Outside Waratek scope1
Not applicable180
Critical1
High84
Medium91
Low5
not blocked181
No public exploit181
2016140
Outside Waratek scope1
Not applicable139
Critical15
High73
Medium51
Low1
not blocked140
No public exploit140
20179
Not applicable9
Critical2
High6
Medium1
not blocked9
No public exploit9
2018347
Not applicable347
Critical114
High114
Medium117
Low2
not blocked347
No public exploit347
2019132
Not applicable132
Critical34
High44
Medium53
Low1
not blocked132
No public exploit132
2020174
Outside Waratek scope2
Not applicable172
Critical15
High74
Medium82
Low3
not blocked174
No public exploit174
2021152
Outside Waratek scope1
Not applicable151
Critical7
High65
Medium78
Low2
not blocked152
No public exploit152
2022120
Not applicable120
Critical13
High51
Medium56
not blocked120
No public exploit120
2023159
Not applicable159
Critical20
High56
Medium81
Low2
not blocked159
No public exploit159
2024195
Not applicable195
Critical32
High76
Medium84
Low3
not blocked195
No public exploit195
2025205
No exploit published1
Not applicable204
Critical45
High77
Medium79
Low4
not blocked205
No public exploit205
2026589
Not applicable589
Critical208
High269
Medium112
not blocked589
No public exploit589
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-106016 | Critical | 2026-10-06 | Not applicable | No public exploit | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158. |
| CVE-2026-103500 | Medium | 2026-09-30 | Not applicable | No public exploit | An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. |
| CVE-2026-96869 | Medium | 2026-09-29 | Not applicable | No public exploit | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100832 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100831 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100830 | High | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100829 | Critical | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100828 | Critical | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100826 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100825 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100824 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100823 | Medium | 2026-09-29 | Not applicable | No public exploit | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157. |
| CVE-2026-100822 | Medium | 2026-09-29 | Not applicable | No public exploit | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100821 | Medium | 2026-09-29 | Not applicable | No public exploit | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100820 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100819 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100818 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100817 | Medium | 2026-09-29 | Not applicable | No public exploit | Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100816 | High | 2026-09-29 | Not applicable | No public exploit | Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100815 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100814 | High | 2026-09-29 | Not applicable | No public exploit | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100813 | High | 2026-09-29 | Not applicable | No public exploit | Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100812 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100811 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100810 | Critical | 2026-09-29 | Not applicable | No public exploit | Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100809 | High | 2026-09-29 | Not applicable | No public exploit | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100808 | High | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100807 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100806 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100805 | High | 2026-09-29 | Not applicable | No public exploit | Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100804 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100803 | High | 2026-09-29 | Not applicable | No public exploit | Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100802 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100801 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100800 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100799 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100798 | High | 2026-09-29 | Not applicable | No public exploit | Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100797 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100796 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100795 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100794 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100793 | Medium | 2026-09-29 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100792 | High | 2026-09-29 | Not applicable | No public exploit | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100791 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100790 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100789 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100788 | Critical | 2026-09-29 | Not applicable | No public exploit | Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100787 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100786 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100785 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100784 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100783 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100782 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100781 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100780 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100779 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100778 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100777 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100776 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100775 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100774 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100773 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100772 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100771 | High | 2026-09-29 | Not applicable | No public exploit | Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100770 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100769 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100768 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100767 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100766 | Medium | 2026-09-29 | Not applicable | No public exploit | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100765 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100764 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100763 | Critical | 2026-09-29 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100762 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100761 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100760 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100759 | High | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100758 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100757 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100756 | High | 2026-09-29 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-92240 | Critical | 2026-09-15 | Not applicable | No public exploit | A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92239 | High | 2026-09-15 | Not applicable | No public exploit | A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92238 | Critical | 2026-09-15 | Not applicable | No public exploit | A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92079 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92078 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92077 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92076 | High | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92075 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92074 | High | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92073 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92072 | High | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92071 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92070 | Medium | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92069 | Medium | 2026-09-15 | Not applicable | No public exploit | Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92068 | Medium | 2026-09-15 | Not applicable | No public exploit | Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92067 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92066 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92065 | High | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92064 | High | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92063 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92062 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |