Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Mozilla ThunderbirdHeap buffer overflow opening large email

Risk 41
Severity
6.1
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size.

1 / 2
Source: Mozilla
First published (updated )
CVE-2026-103500

Mozilla Firefox ESRUse-after-free in the Widget component

Risk 77
Severity
8.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100757

Mozilla Firefox ESRSandbox escape in the DOM: Navigation component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100758

Mozilla Firefox ESRUninitialized memory in the Storage: Quota Manager component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100759

Mozilla FirefoxSandbox escape in the Security: Process Sandboxing component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100760

Mozilla Firefox ESRSandbox escape due to use-after-free in the DOM: Content Processes component

Risk 80
Severity
9.6
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100762

Mozilla FirefoxUse-after-free in the JavaScript: WebAssembly component

Risk 77
Severity
8.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100765

Mozilla Firefox ESRInformation disclosure in the Networking: JAR component

Risk 22
Severity
4.3
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100766

Mozilla Firefox ESRSite isolation issue in the Panning and Zooming component

Risk 24
Severity
4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100821

Mozilla FirefoxSpoofing issue in the Networking: HTTP component

Risk 34
Severity
5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100822

Mozilla FirefoxPrivilege escalation in the Places component

Risk 77
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100824

Mozilla FirefoxUse-after-free in the JavaScript Engine: JIT component

Risk 77
Severity
8.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100825

Mozilla FirefoxDenial-of-service in the Storage: StorageManager component

Risk 37
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100826

Mozilla FirefoxMitigation bypass in the Bookmarks & History component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100828

Mozilla FirefoxMitigation bypass in the DOM: Security component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100829

Mozilla FirefoxMitigation bypass in the DOM: Navigation component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100830

Mozilla FirefoxUse-after-free in the DOM: UI Events & Focus Handling component

Risk 77
Severity
8.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100831

Mozilla FirefoxUse-after-free in the DOM: Navigation component

Risk 56
Severity
8.8
EPSS
0.16%
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92025

Mozilla FirefoxUse-after-free in the Networking component

Risk 56
Severity
8.8
EPSS
0.16%
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92026

Mozilla FirefoxUse-after-free in the DOM: Streams component

Risk 56
Severity
8.8
EPSS
0.16%
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92027

Mozilla FirefoxUse-after-free in the DOM: Core & HTML component

Risk 56
Severity
8.8
EPSS
0.16%
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92028

Mozilla FirefoxUse-after-free in the SVG component

Risk 56
Severity
8.8
EPSS
0.16%
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92029

FirefoxMitigation bypass in the DOM: Copy & Paste and Drag & Drop component

Risk 24
Severity
5.4
EPSS
0.16%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92030

Mozilla FirefoxInformation disclosure in the Graphics: ImageLib component

Risk 27
Severity
6.5
EPSS
0.16%
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92031

Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Risk 56
Severity
8.8
EPSS
0.34%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92006

Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Risk 56
Severity
8.8
EPSS
0.27%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92007

Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Risk 56
Severity
8.8
EPSS
0.27%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92008

Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Risk 56
Severity
8.8
EPSS
0.27%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92009

Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Risk 56
Severity
8.8
EPSS
0.27%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92010

Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Risk 56
Severity
8.8
EPSS
0.27%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

First published (updated )
CVE-2026-92011

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203