CVE-2026-16380

Mitigation bypass in the Networking component

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16382

Mitigation bypass in the DOM: Service Workers component

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16384

Information disclosure due to uninitialized memory in the Graphics: WebGPU component

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16394

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-16395

Integer overflow in the Audio/Video component

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-16397

Clickjacking issue in the WebExtensions component in Firefox for Android

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-16398

Site isolation issue in the Graphics component

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16400

Information disclosure in the DOM: Security component

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16403

Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16404

Spoofing issue in Firefox for Android

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Mobile

CVE-2026-16406

Mitigation bypass in the Networking component

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-16408

Integer overflow in the Audio/Video: Playback component

Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-16409

Invalid pointer in the Security: PSM component

Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-16410

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-66448

WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpchill

Products

Wordpress Gallery Photoblocks

CVE-2026-59534

WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Aurovrata Venet Wordpress

Products

Post My Cf7 Form Wordpress

CVE-2026-59546

WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability

Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

John Darrel Wordpress

Products

Hide My Wp Ghost Wordpress

CVE-2026-59553

WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rextheme Wordpress

Products

Product Feed Manager Wordpress

CVE-2026-66427

WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Jgwhite33 Wordpress

Products

Wp Google Review Slider Wordpress

CVE-2026-48037

Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kerberosmansour

Products

Hulumi