CVE database

94,291 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.

• 9.6 Critical severity

  Firefox: Use After Free

  CVE-2026-117985Oct 27, 2026Mozilla

  Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117984Oct 27, 2026Mozilla

  Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 9.8 Critical severity

  Firefox: Use After Free

  CVE-2026-117982Oct 27, 2026Mozilla

  Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 9.8 Critical severity

  Firefox: Improper Privilege Management

  CVE-2026-117981Oct 27, 2026Mozilla

  Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117979Oct 27, 2026Mozilla

  Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117978Oct 27, 2026Mozilla

  Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Origin Validation Error

  CVE-2026-117976Oct 27, 2026Mozilla

  Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117975Oct 27, 2026Mozilla

  Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117974Oct 27, 2026Mozilla

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117973Oct 27, 2026Mozilla

  Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 9.6 Critical severity

  Firefox: Use After Free

  CVE-2026-117971Oct 27, 2026Mozilla

  Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-117970Oct 27, 2026Mozilla

  Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Access of Uninitialized Pointer

  CVE-2026-117969Oct 27, 2026Mozilla

  Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117968Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Protection Mechanism Failure

  CVE-2026-117967Oct 27, 2026Mozilla

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Origin Validation Error

  CVE-2026-117966Oct 27, 2026Mozilla

  Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Origin Validation Error

  CVE-2026-117965Oct 27, 2026Mozilla

  Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117964Oct 27, 2026Mozilla

  Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117963Oct 27, 2026Mozilla

  Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 9.6 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117962Oct 27, 2026Mozilla

  Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117961Oct 27, 2026Mozilla

  Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Improper Access Control

  CVE-2026-117959Oct 27, 2026Mozilla

  Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Origin Validation Error

  CVE-2026-117958Oct 27, 2026Mozilla

  Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Missing Cryptographic Step

  CVE-2026-117957Oct 27, 2026Mozilla

  Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Access of Uninitialized Pointer

  CVE-2026-117956Oct 27, 2026Mozilla

  Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Access of Resource Using Incompatible Type

  CVE-2026-117955Oct 27, 2026Mozilla

  JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117954Oct 27, 2026Mozilla

  Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117953Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.1 High severity

  Firefox: Use of Uninitialized Variable

  CVE-2026-117952Oct 27, 2026Mozilla

  Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117951Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117950Oct 27, 2026Mozilla

  Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117949Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 9.8 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117946Oct 27, 2026Mozilla

  Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 9.8 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117945Oct 27, 2026Mozilla

  Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Double Free

  CVE-2026-117943Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 7.3 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-117942Oct 27, 2026Mozilla

  Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117941Oct 27, 2026Mozilla

  Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117940Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 7.3 High severity

  Firefox: Access of Uninitialized Pointer

  CVE-2026-117937Oct 27, 2026Mozilla

  Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-117936Oct 27, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.