CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Site isolation issue in the Graphics component in Firefox and Thunderbird. Fixed in version 153.
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Information disclosure vulnerability in the Storage: IndexedDB component. This flaw was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
Vulnerability in Firefox and Thunderbird (DOM: Content Processes component) allows privilege escalation. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Denial-of-service vulnerability in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Information disclosure vulnerability in the Framework component in DevTools. This flaw was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Vulnerability in the Privacy component in Firefox for Android. The flaw leads to information disclosure. The issue was fixed in Firefox 153.
Vulnerability in the DOM: Content Processes component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
Vulnerability in the DOM: Navigation component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.
Use-after-free vulnerability in the WebRTC: Audio/Video component of Firefox and Thunderbird. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Information disclosure vulnerability in the Graphics: ImageLib component. This flaw was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Use-After-Free vulnerability in Rust deserialization logic of Apache Fory versions 0.13.0 through 1.3.0. A crafted Fory payload can cause undefined behavior, process crash, or potential memory disclosure.
Arbitrary file upload vulnerability in MapSVG plugin for WordPress (all versions up to 8.14.0) due to missing file type validation in SVGFile constructor. Requires admin access.
A vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6524 allows Multi Factor Authentication (MFA) bypass. An attacker can exploit this flaw to gain unauthorized access to the system without completing additional authentication factors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS