Tracked app vulnerabilities

Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.

Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.

Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

MEDIUM 5.5

2026-10-13

Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.

Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a …

Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.

No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.

Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

MEDIUM 6.5

2026-10-13

Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 4.2

2026-10-13

Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 4.3

2026-10-13

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 15…

MEDIUM 4.2

2026-10-13

Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 6.5

2026-10-13

Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 6.5

2026-10-13

Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 4.3

2026-10-13

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 6.1

2026-10-13

Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 4.3

2026-10-13

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 6.5

2026-10-13

Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 4.3

2026-10-13

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 4.2

2026-10-13

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbir…

MEDIUM 5.4

2026-10-13

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 5.4

2026-10-13

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 5.4

2026-10-13

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 5.4

2026-10-13

Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 4.3

2026-10-13

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 5.4

2026-10-13

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 5.4

2026-10-13

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 4.3

2026-10-13

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 5.4

2026-10-13

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 1…

MEDIUM 5.4

2026-10-13

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

MEDIUM 5.4

2026-10-13

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

MEDIUM 5.4

2026-10-13

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderb…