Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,052 alerts · page 47 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-117982 Invalid pointer in the JavaScript Engine: JIT component

    CriticalCVSS 9.8 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-117980 Use-after-free in the Graphics component

    CriticalCVSS 9.8 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, redhat/rhel10/thunderbird-flatpak and 8 more

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-117981 Privilege escalation in the Toolkit component

    CriticalCVSS 9.8 EPSS 0.47%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-117971 Sandbox escape due to use-after-free in the Print Preview component

    CriticalCVSS 9.6 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, redhat/firefox and 10 more

    Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-117962 Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component

    CriticalCVSS 9.6 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-117946 Incorrect boundary conditions in the JavaScript Engine component

    CriticalCVSS 9.8 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-117945 Incorrect boundary conditions in the XML component

    CriticalCVSS 9.8 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-117920 Use-after-free in the DOM: HTML Parser component

    CriticalCVSS 9.6 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, redhat/firefox and 10 more

    Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-117917 Invalid pointer in the Graphics: WebRender component

    CriticalCVSS 9.8 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-117868 Sandbox escape in the DOM: Networking component

    CriticalCVSS 9.6 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-117861 Sandbox escape in the DOM: Navigation component

    CriticalCVSS 9.6 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-117862 Privilege escalation due to incorrect boundary conditions in the Networking component

    CriticalCVSS 9.8 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird, debian/firefox-esr and 6 more

    Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

    CriticalCVSS 9.3 EPSS 0.19%

    Exploit status: No public exploit known

    Affects: spesmilo electrum, debian/electrum

    Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice reques...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions

    CriticalCVSS 9.3 EPSS 0.18%

    Exploit status: No public exploit known

    Affects: pypi electrum, spesmilo electrum, debian/electrum

    Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee cop...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-117564 nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret

    CriticalCVSS 9.3 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: buqiyuan nest-admin

    nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-65145 NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tamperin...

    CriticalCVSS 10.0 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: NVIDIA NeMo Agent Toolkit

    NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials

    CriticalCVSS 9.1 EPSS 0.24%

    Exploit status: No public exploit known

    Affects: Eclipse Foundation Eclipse ioFog

    In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

    CriticalCVSS 9.1 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: @fastify/express

    @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash n...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

    CriticalCVSS 9.3 EPSS 0.68%

    Exploit status: No public exploit known

    Affects: redaxo core

    REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for ac...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB

    CriticalCVSS 9.8 EPSS 0.64%

    Exploit status: No public exploit known

    Affects: Hitachi HiRDB Server Version 10, Hitachi HiRDB Server Version 9, Hitachi HiRDB Server with Additional Function Version 9 and 2 more

    Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).