Browse CVEs

CRITICAL 10.0 CVE-2026-16367 Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. Firefox 153.0 / 153.0.0+ Fix from $2,3002026-07-21 CRITICAL 9.1 CVE-2026-16364 Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. Firefox 153.0 / 153.0.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16363 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Th… Firefox 140.13.0 / 153.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16360 Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we … Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16358 Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thund… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16357 Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunder… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16356 Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefo… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16355 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thun… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16361 Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort … Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.1 CVE-2026-16359 Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13,… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunder… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16352 Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefo… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16351 Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 1… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16350 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.1… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-16349 Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thun… Firefox 115.38.0 / 140.13.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-65008 Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), w… No fix yet Fix from $2,3002026-07-21 CRITICAL 9.6 CVE-2026-65007 The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGen… No fix yet Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-1617 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspo… No fix yet Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-64606 Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lamb… Fory 1.4.0+ Fix from $2,3002026-07-21 CRITICAL 9.1 CVE-2026-64609 Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the b… Fory 1.4.0+ Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-64608 Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip pa… Fory 1.4.0+ Fix from $2,3002026-07-21 CRITICAL 9.1 CVE-2026-62415 Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2… No fix yet Fix from $2,3002026-07-21 CRITICAL 9.8 CVE-2026-13439 The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, a… No fix yet Fix from $2,3002026-07-21 CRITICAL 9.6 CVE-2026-15901 Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… Chrome 150.0.7871.128+ Fix from $2,3002026-07-20 CRITICAL 9.6 CVE-2026-15900 Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a cra… Chrome 150.0.7871.128+ Fix from $2,3002026-07-20 CRITICAL 9.6 CVE-2026-15899 Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via… Chrome 150.0.7871.128+ Fix from $2,3002026-07-20 CRITICAL 9.8 CVE-2026-64625 AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command… No fix yet Fix from $2,3002026-07-20 CRITICAL 9.8 CVE-2026-52656 An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary … No fix yet Fix from $2,3002026-07-20 CRITICAL 9.8 CVE-2024-51315 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName No fix yet Fix from $2,3002026-07-20 CRITICAL 9.8 CVE-2024-51314 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg. Mitigation only Fix from $2,3002026-07-20