CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Privilege escalation vulnerability in the Places component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Privilege escalation vulnerability in the Address Bar component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Use-after-free vulnerability in the CSS Parsing and Computation component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Incorrect boundary conditions in the JavaScript Engine: JIT component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Invalid pointer in the JavaScript Engine: JIT component. Fixed in Thunderbird 157 and Firefox 157.
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Vulnerability allows bypassing security mechanisms in the DOM: Service Workers component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Privilege escalation vulnerability in the DOM: Service Workers component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Race condition and use-after-free vulnerability in the Audio/Video component. Fixed in Thunderbird 157 and Firefox 157.
Vulnerability allows bypassing the same-origin policy in the WebExtensions component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Privilege escalation vulnerability in the DLL Services component. It was fixed in multiple Firefox and Thunderbird versions, including Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Vulnerability related to improper use of cryptography in the Storage: Quota Manager component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Privilege escalation due to use-after-free in the Graphics: WebRender component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Use-after-free vulnerability in the JavaScript: WebAssembly component. Fixed in Thunderbird 157 and Firefox 157.
Vulnerability related to JIT miscompilation in the JavaScript: WebAssembly component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Use-after-free vulnerability in the DOM: Core & HTML component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Use-after-free vulnerability in the XSLT component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS