Overview 3,934 matches · 1 in Waratek scope · 0 protected · 35 exploited · 15 CISA KEV · 159 public PoC · 28 EPSS ≥ 0.5
3,934matches
1in Waratek scope0.0%
0protected0.0%
35exploited0.9%
15CISA KEV0.4%
159public PoC4.0%
28EPSS ≥ 0.50.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.0%
Outside Waratek scope
16
0.4%
Not applicable
3,917
99.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
3,934
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 592 / year
20002
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
200110
Not applicable10
High7
Medium1
Low2
not blocked10
Working exploit published2
No public exploit8
200230
Not applicable30
High16
Medium12
Low2
not blocked30
Working exploit published3
No public exploit27
200313
Not applicable13
Critical1
High3
Medium6
Low3
not blocked13
Working exploit published2
No public exploit11
200454
Outside Waratek scope1
Not applicable53
High19
Medium29
Low6
not blocked54
Working exploit published6
No public exploit48
200593
Not applicable93
High28
Medium43
Low22
not blocked93
Working exploit published11
No public exploit82
2006122
Not applicable122
High50
Medium57
Low15
not blocked122
Exploited1
Working exploit published12
No public exploit109
200787
Not applicable87
Critical1
High27
Medium57
Low2
not blocked87
Working exploit published8
Forecast only1
No public exploit78
200898
Not applicable98
High42
Medium53
Low3
not blocked98
Working exploit published7
No public exploit91
2009143
Outside Waratek scope3
Not applicable140
Critical1
High72
Medium66
Low4
not blocked143
Exploited3
Working exploit published24
No public exploit116
2010123
Not applicable123
Critical2
High62
Medium55
Low4
not blocked123
Exploited1
Working exploit published11
No public exploit111
2011117
Not applicable117
High66
Medium47
Low4
not blocked117
Working exploit published4
Proof of concept only1
No public exploit112
2012205
Not applicable205
High122
Medium78
Low5
not blocked205
Working exploit published2
Proof of concept only1
No public exploit202
2013161
Outside Waratek scope1
Not applicable160
Critical6
High93
Medium61
Low1
not blocked161
Exploited4
Working exploit published6
Forecast only1
No public exploit150
2014120
Outside Waratek scope3
Not applicable117
Critical9
High53
Medium55
Low3
not blocked120
Exploited2
Working exploit published3
No public exploit115
2015188
Outside Waratek scope2
Not applicable186
Critical1
High86
Medium94
Low7
not blocked188
Exploited2
Working exploit published3
Proof of concept only2
No public exploit181
2016142
Outside Waratek scope1
Not applicable141
Critical15
High75
Medium51
Low1
not blocked142
Working exploit published2
No public exploit140
20179
Not applicable9
Critical2
High6
Medium1
not blocked9
No public exploit9
2018358
Not applicable358
Critical120
High117
Medium119
Low2
not blocked358
Exploited1
Working exploit published9
Proof of concept only1
No public exploit347
2019146
Not applicable146
Critical41
High49
Medium55
Low1
not blocked146
Exploited5
Working exploit published8
Proof of concept only1
No public exploit132
2020179
Outside Waratek scope2
Not applicable177
Critical15
High78
Medium83
Low3
not blocked179
Exploited4
Working exploit published1
No public exploit174
2021154
Outside Waratek scope1
Not applicable153
Critical7
High66
Medium79
Low2
not blocked154
Exploited1
Proof of concept only1
No public exploit152
2022181
Not applicable181
Critical20
High75
Medium85
Low1
not blocked181
Exploited7
Proof of concept only54
No public exploit120
2023197
Outside Waratek scope1
Not applicable196
Critical20
High73
Medium102
Low2
not blocked197
Exploited2
Proof of concept only36
No public exploit159
2024202
Outside Waratek scope1
Not applicable201
Critical35
High79
Medium85
Low3
not blocked202
Exploited1
Working exploit published1
Proof of concept only5
No public exploit195
2025208
No exploit published1
Not applicable207
Critical47
High77
Medium80
Low4
not blocked208
Exploited1
Proof of concept only2
No public exploit205
2026592
Not applicable592
Critical210
High270
Medium112
not blocked592
Proof of concept only3
No public exploit589
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-106016 | Critical | 2026-10-06 | Not applicable | No public exploit | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158. |
| CVE-2026-103500 | Medium | 2026-09-30 | Not applicable | No public exploit | An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. |
| CVE-2026-96869 | Medium | 2026-09-29 | Not applicable | No public exploit | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100832 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100831 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100830 | High | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100829 | Critical | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100828 | Critical | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100826 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100825 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100824 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100823 | Medium | 2026-09-29 | Not applicable | No public exploit | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157. |
| CVE-2026-100822 | Medium | 2026-09-29 | Not applicable | No public exploit | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100821 | Medium | 2026-09-29 | Not applicable | No public exploit | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100820 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100819 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100818 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100817 | Medium | 2026-09-29 | Not applicable | No public exploit | Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100816 | High | 2026-09-29 | Not applicable | No public exploit | Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100815 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100814 | High | 2026-09-29 | Not applicable | No public exploit | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100813 | High | 2026-09-29 | Not applicable | No public exploit | Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100812 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100811 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100810 | Critical | 2026-09-29 | Not applicable | No public exploit | Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100809 | High | 2026-09-29 | Not applicable | No public exploit | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100808 | High | 2026-09-29 | Not applicable | No public exploit | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100807 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100806 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100805 | High | 2026-09-29 | Not applicable | No public exploit | Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100804 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100803 | High | 2026-09-29 | Not applicable | No public exploit | Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100802 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100801 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100800 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100799 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100798 | High | 2026-09-29 | Not applicable | No public exploit | Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100797 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100796 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100795 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100794 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100793 | Medium | 2026-09-29 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100792 | High | 2026-09-29 | Not applicable | No public exploit | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100791 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100790 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100789 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100788 | Critical | 2026-09-29 | Not applicable | No public exploit | Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100787 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100786 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100785 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100784 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100783 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100782 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100781 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100780 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100779 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100778 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100777 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100776 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100775 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100774 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100773 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100772 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100771 | High | 2026-09-29 | Not applicable | No public exploit | Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100770 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100769 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100768 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100767 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100766 | Medium | 2026-09-29 | Not applicable | No public exploit | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100765 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100764 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100763 | Critical | 2026-09-29 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100762 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100761 | High | 2026-09-29 | Not applicable | No public exploit | Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100760 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100759 | High | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100758 | Critical | 2026-09-29 | Not applicable | No public exploit | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100757 | High | 2026-09-29 | Not applicable | No public exploit | Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100756 | High | 2026-09-29 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-92240 | Critical | 2026-09-15 | Not applicable | No public exploit | A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92239 | High | 2026-09-15 | Not applicable | No public exploit | A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92238 | Critical | 2026-09-15 | Not applicable | No public exploit | A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92079 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92078 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92077 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92076 | High | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92075 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92074 | High | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92073 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92072 | High | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92071 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92070 | Medium | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92069 | Medium | 2026-09-15 | Not applicable | No public exploit | Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92068 | Medium | 2026-09-15 | Not applicable | No public exploit | Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92067 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92066 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92065 | High | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92064 | High | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92063 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92062 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |