Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109741 | medium | 5.4 | No | Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158... | 2026-10-13 |
| CVE-2026-109738 | medium | 5.4 | No | Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and... | 2026-10-13 |
| CVE-2026-109735 | medium | 5.4 | No | Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-13 |
| CVE-2026-109732 | medium | 5.4 | No | Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbir... | 2026-10-13 |
| CVE-2026-109729 | medium | 5.4 | No | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5,... | 2026-10-13 |
| CVE-2026-109728 | medium | 5.4 | No | Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderb... | 2026-10-13 |
| CVE-2026-109727 | medium | 5.4 | No | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird... | 2026-10-13 |
| CVE-2026-109726 | medium | 5.4 | No | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, an... | 2026-10-13 |
| CVE-2026-109725 | medium | 5.4 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunde... | 2026-10-13 |
| CVE-2026-109724 | medium | 5.4 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thund... | 2026-10-13 |
| CVE-2026-109719 | medium | 4.2 | No | Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Fire... | 2026-10-13 |
| CVE-2026-109718 | medium | 5.4 | No | Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, an... | 2026-10-13 |
| CVE-2026-109717 | medium | 5.4 | No | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and... | 2026-10-13 |
| CVE-2026-109713 | medium | 5.4 | No | Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunde... | 2026-10-13 |
| CVE-2026-109711 | medium | 5.4 | No | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thu... | 2026-10-13 |
| CVE-2026-109710 | medium | 5.4 | No | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderb... | 2026-10-13 |
| CVE-2026-109706 | medium | 5.4 | No | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thun... | 2026-10-13 |
| CVE-2026-109335 | medium | 6.5 | No | SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-l... | 2026-10-13 |
| CVE-2026-109330 | medium | 4.3 | No | Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to re... | 2026-10-13 |
| CVE-2026-109325 | high | 7.5 | No | Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR val... | 2026-10-13 |