Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117904 | high | 8.8 | No | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunder... | 2026-11-04 |
| CVE-2026-117903 | medium | 6.3 | No | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird... | 2026-11-04 |
| CVE-2026-117902 | medium | 6.3 | No | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and... | 2026-11-04 |
| CVE-2026-117901 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117900 | high | 8.8 | No | Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird... | 2026-11-04 |
| CVE-2026-117899 | high | 8.8 | No | Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117898 | medium | 6.3 | No | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and... | 2026-11-04 |
| CVE-2026-117887 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117886 | high | 8.1 | No | Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR... | 2026-11-04 |
| CVE-2026-117885 | medium | 6.3 | No | Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbi... | 2026-11-04 |
| CVE-2026-117884 | high | 8.8 | No | Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird... | 2026-11-04 |
| CVE-2026-117883 | high | 8.8 | No | Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117882 | medium | 6.3 | No | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,... | 2026-11-04 |
| CVE-2026-117881 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117880 | medium | 6.3 | No | Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, an... | 2026-11-04 |
| CVE-2026-115574 | medium | 5.3 | No | Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/... | 2026-11-04 |
| CVE-2026-117606 | medium | 5.4 | No | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' regist... | 2026-11-04 |
| CVE-2026-116806 | medium | 5.4 | No | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organiza... | 2026-11-04 |
| CVE-2026-116487 | medium | 4.6 | No | NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisS... | 2026-11-04 |
| CVE-2026-116069 | medium | 6.5 | No | NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server... | 2026-11-04 |