Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

161 advisories match Clear all Export 25 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	5.4	CVE-2026-113470	Cryptographic issue in the Security Block-lists, Allow-lists, and other State component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 20 13:16 UTC
CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists, and other State component From the advisory Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 20, 2026 13:16 UTC Read the advisory
	Medium	6.5	CVE-2026-113401	Denial-of-service in the PDF Viewer component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 20 13:16 UTC
CVE-2026-113401Denial-of-service in the PDF Viewer component From the advisory Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 20, 2026 13:16 UTC Read the advisory
	Medium	5.4	CVE-2026-113400	Uninitialized memory in the Audio/Video: cubeb component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 20 13:16 UTC
CVE-2026-113400Uninitialized memory in the Audio/Video: cubeb component From the advisory Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 20, 2026 13:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-113399	Incorrect boundary conditions in the SVG component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 20 13:16 UTC
CVE-2026-113399Incorrect boundary conditions in the SVG component From the advisory Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 20, 2026 13:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-109783	Mitigation bypass in the File Handling component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109783Mitigation bypass in the File Handling component From the advisory Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-109782	Mitigation bypass in the File Handling component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109782Mitigation bypass in the File Handling component From the advisory Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	6.5	CVE-2026-109781	Denial-of-service in the Printing: Output component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109781Denial-of-service in the Printing: Output component From the advisory Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-109780	Mitigation bypass in the DOM: Core & HTML component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109780Mitigation bypass in the DOM: Core & HTML component From the advisory Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.2	CVE-2026-109779	Race condition in the Networking: DNS component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109779Race condition in the Networking: DNS component From the advisory Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-109778	Privilege escalation in the WebExtensions component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109778Privilege escalation in the WebExtensions component From the advisory Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.3	CVE-2026-109777	Information disclosure in the Storage: IndexedDB component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109777Information disclosure in the Storage: IndexedDB component From the advisory Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.2	CVE-2026-109776	Race condition in the XPCOM component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109776Race condition in the XPCOM component From the advisory Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	6.5	CVE-2026-109775	Denial-of-service in the WebRTC component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109775Denial-of-service in the WebRTC component From the advisory Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-109774	Invalid pointer, undefined behavior in the DOM: Notifications component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109774Invalid pointer, undefined behavior in the DOM: Notifications component From the advisory Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	6.5	CVE-2026-109773	Denial-of-service in the Sync component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109773Denial-of-service in the Sync component From the advisory Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-109772	Same-origin policy bypass in the DevTools component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109772Same-origin policy bypass in the DevTools component From the advisory Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.3	CVE-2026-109771	Information disclosure in the WebRTC: Networking component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109771Information disclosure in the WebRTC: Networking component From the advisory Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	6.1	CVE-2026-109770	Spoofing issue in the DOM: Web Serial component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109770Spoofing issue in the DOM: Web Serial component From the advisory Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.3	CVE-2026-109769	Information disclosure in the Networking: Cache component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109769Information disclosure in the Networking: Cache component From the advisory Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	6.5	CVE-2026-109768	Denial-of-service in the Site Reports component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109768Denial-of-service in the Site Reports component From the advisory Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.3	CVE-2026-109767	Information disclosure in the Networking component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109767Information disclosure in the Networking component From the advisory Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-109766	Mitigation bypass in the Enterprise Policies component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109766Mitigation bypass in the Enterprise Policies component From the advisory Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	4.2	CVE-2026-109765	Race condition, use-after-free in the Graphics: Text component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109765Race condition, use-after-free in the Graphics: Text component From the advisory Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Medium	5.4	CVE-2026-109764	Mitigation bypass in the Enterprise Policies component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109764Mitigation bypass in the Enterprise Policies component From the advisory Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-109763	Mitigation bypass in the File Handling component MozillaMozilla Firefox, Mozilla Thunderbird	NVD	Oct 13 13:17 UTC
CVE-2026-109763Mitigation bypass in the File Handling component From the advisory Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Score No CVSS score published. Affects Mozilla Mozilla Firefox Mozilla Thunderbird NIST National Vulnerability DatabasePublished Oct 13, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Score

Affects

From the advisory

Score

Affects

From the advisory

Score

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Score

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Score

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Score

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory