CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The 'stringprep' module did not process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This causes mismatches when processing domain names using IDNA 2003 (the 'idna' codec) and the in_table_b2() function of the 'stringprep' module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.
Sandbox escape in the Remote Settings Client component. Fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.
A stack-based buffer overflow vulnerability has been detected in the DHCP blobmsg Handler of the /sbin/netifd file in TRENDnet TEW-WLC100P version 12.07b01. The attack must be carried out from within the local network.
SQL injection vulnerability in Task Management System 1.0, in the function Operation::select_with_multiple_condition in /index.php, in the Login Form component, via the email argument. The attack can be launched remotely, and the exploit is publicly available.
Internally found bugs were present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect, and it is presumed that with enough effort some could have been exploited. The vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Internally found bugs were present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect, and it is presumed that with enough effort some could have been exploited. The vulnerability was fixed in Firefox 154 and Thunderbird 154.
Internally found bugs were present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect, and it is presumed that with enough effort some could have been exploited. The vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Internally found bugs were present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect, and it is presumed that with enough effort some could have been exploited. The vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Race condition vulnerability in the JavaScript Engine component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Mitigation bypass in the Data Loss Prevention component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Denial-of-service vulnerability in the Widget component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Site isolation issue in the Audio/Video: Web Codecs component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Clickjacking vulnerability in the Widget component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Integer overflow in the Graphics component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
JIT miscompilation in the JavaScript Engine: JIT component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
A spoofing issue exists in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS