Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (424788 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-124949 2026-11-10 3.4 Low
Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124947 2026-11-10 8.8 High
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124946 2026-11-10 3.4 Low
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124945 2026-11-10 3.4 Low
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124944 2026-11-10 4.3 Medium
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124943 2026-11-10 8.8 High
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124936 2026-11-10 3.4 Low
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124928 2026-11-10 6.1 Medium
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124925 2026-11-10 4.3 Medium
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124923 2026-11-10 6.1 Medium
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124921 2026-11-10 6.1 Medium
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124920 2026-11-10 6.1 Medium
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124908 2026-11-10 8.8 High
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124904 2026-11-10 8.8 High
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124900 2026-11-10 9.6 Critical
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124878 2026-11-10 8.8 High
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124871 2026-11-10 8.8 High
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124867 2026-11-10 8.8 High
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124852 2026-11-10 8.8 High
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-123814 1 Pyload 1 Pyload 2026-11-10 6.4 Medium
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.