2026

Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, T

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.

Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbi

Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunder

Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbi

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.

Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ES

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firef

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firef

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox E

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR

Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefo

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firef

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbi

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was f

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.

Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firef

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115

Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16,

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Fi

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Fir

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API auth

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid exce

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always eval

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attacker

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verif

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddlewa

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoin

A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE messa

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to exec

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, a

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoin