Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1640 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-2799 1 Mozilla 2 Firefox, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
CVE-2026-2797 1 Mozilla 2 Firefox, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
CVE-2026-2795 1 Mozilla 2 Firefox, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
CVE-2026-2789 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2772 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2770 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2768 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 10.0 Critical
Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2024-5692 2 Microsoft, Mozilla 3 Windows, Firefox, Thunderbird 2026-02-26 6.5 Medium
On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVE-2026-2803 1 Mozilla 2 Firefox, Thunderbird 2026-02-26 7.5 High
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
CVE-2026-2801 1 Mozilla 2 Firefox, Thunderbird 2026-02-26 7.5 High
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
CVE-2026-2800 1 Mozilla 2 Firefox, Thunderbird 2026-02-26 9.8 Critical
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148 and Thunderbird < 148.
CVE-2026-2790 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2787 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2786 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2785 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2783 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 7.5 High
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2781 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2774 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Integer overflow in the Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2026-2767 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-02-26 9.8 Critical
Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
CVE-2025-3909 2 Mozilla, Redhat 6 Thunderbird, Enterprise Linux, Rhel Aus and 3 more 2026-02-26 6.5 Medium
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.