Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-1020 | critical | 9.8 | No | Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that w... | 2026-10-05 |
| CVE-2025-1017 | critical | 9.8 | No | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of... | 2026-10-05 |
| CVE-2025-1016 | critical | 9.8 | No | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6... | 2026-10-05 |
| CVE-2025-1009 | critical | 9.8 | No | An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fix... | 2026-10-05 |
| CVE-2026-103624 | high | 8.3 | No | Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the r... | 2026-10-05 |
| CVE-2026-103628 | critical | 9.6 | No | Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox... | 2026-10-05 |
| CVE-2026-103625 | high | 8.8 | No | Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-10-05 |
| CVE-2026-103622 | high | 8.8 | No | Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a c... | 2026-10-05 |
| CVE-2026-103626 | critical | 9.6 | No | Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engi... | 2026-10-05 |
| CVE-2026-103629 | medium | 4.3 | No | Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page... | 2026-10-05 |
| CVE-2026-103621 | medium | 4.3 | No | Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HT... | 2026-10-05 |
| CVE-2026-103004 | medium | 5.3 | No | Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with diff... | 2026-10-05 |
| CVE-2026-100781 | critical | 9.6 | No | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4,... | 2026-10-05 |
| CVE-2026-94486 | medium | 5.4 | No | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a M... | 2026-10-05 |
| CVE-2026-94485 | medium | 5.3 | No | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a... | 2026-10-05 |
| CVE-2026-100808 | high | 8.8 | No | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153... | 2026-10-05 |
| CVE-2026-73552 | high | 7.5 | No | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy H... | 2026-10-05 |
| CVE-2026-73511 | medium | 5.3 | No | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy n... | 2026-10-05 |
| CVE-2026-100809 | high | 8.1 | No | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4,... | 2026-10-05 |
| CVE-2026-103678 | high | 8.1 | No | A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text... | 2026-10-05 |