Vulnerabilities
Tracked app vulnerabilities
18,157 CVEs affect a tracked app or OS (High, all platforms). 296 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,157
- Actively exploited
- 296
- Publication window
- 2004-07-27 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-118311
HIGH 8.8
Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafte… |
|
CVE-2026-118307
HIGH 8.8
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.… |
|
CVE-2026-118304
HIGH 8.8
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
|
CVE-2026-118180
HIGH 7.5
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or comp… |
|
CVE-2026-118179
HIGH 8.8
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was n… |
|
CVE-2026-118176
HIGH 8.1
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displa… |
|
CVE-2026-118175
HIGH 7.5
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into th… |
|
CVE-2026-118026
HIGH 8.8
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118025
HIGH 8.8
Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118024
HIGH 8.8
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7. |
|
CVE-2026-118023
HIGH 8.8
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118022
HIGH 8.8
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118021
HIGH 8.8
Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 1… |
|
CVE-2026-118020
HIGH 8.8
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118019
HIGH 8.8
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153… |
|
CVE-2026-118017
HIGH 8.8
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118016
HIGH 8.8
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118015
HIGH 8.8
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118014
HIGH 8.8
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118013
HIGH 8.8
Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118012
HIGH 8.8
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118011
HIGH 8.8
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118010
HIGH 8.8
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118009
HIGH 8.8
Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118008
HIGH 8.8
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118007
HIGH 8.8
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7. |
|
CVE-2026-118006
HIGH 8.8
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118005
HIGH 8.8
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. |
|
CVE-2026-118004
HIGH 8.1
Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,… |
|
CVE-2026-118003
HIGH 8.1
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-118002
HIGH 8.1
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and … |
|
CVE-2026-118000
HIGH 8.1
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.… |
|
CVE-2026-117999
HIGH 8.8
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117998
HIGH 8.8
Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 15… |
|
CVE-2026-117996
HIGH 8.1
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117995
HIGH 8.8
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thu… |
|
CVE-2026-117994
HIGH 8.8
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117993
HIGH 8.8
Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117991
HIGH 8.8
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thu… |
|
CVE-2026-117989
HIGH 8.8
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117987
HIGH 8.8
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117986
HIGH 8.8
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117984
HIGH 8.8
Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,… |
|
CVE-2026-117983
HIGH 8.8
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117979
HIGH 8.8
Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunder… |
|
CVE-2026-117978
HIGH 8.1
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, a… |
|
CVE-2026-117977
HIGH 8.1
Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117976
HIGH 8.1
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117975
HIGH 8.8
Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, an… |
|
CVE-2026-117974
HIGH 8.8
Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.