CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.31)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Information disclosure vulnerability in the Storage: IndexedDB component. This flaw was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
Vulnerability in Firefox and Thunderbird (DOM: Content Processes component) allows privilege escalation. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Denial-of-service vulnerability in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Information disclosure vulnerability in the Framework component in DevTools. This flaw was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Vulnerability in the Privacy component in Firefox for Android. The flaw leads to information disclosure. The issue was fixed in Firefox 153.
Vulnerability in the DOM: Content Processes component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
Vulnerability in Firefox and Thunderbird (DOM: Navigation component) allows privilege escalation. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Vulnerability in the DOM: Navigation component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
Vulnerability in the DOM: Workers component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
Use-after-free vulnerability in the WebRTC: Audio/Video component of Firefox and Thunderbird. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Information disclosure vulnerability in the Graphics: ImageLib component. This flaw was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Use-After-Free vulnerability in Rust deserialization logic of Apache Fory versions 0.13.0 through 1.3.0. A crafted Fory payload can cause undefined behavior, process crash, or potential memory disclosure.
Arbitrary file upload vulnerability in MapSVG plugin for WordPress (all versions up to 8.14.0) due to missing file type validation in SVGFile constructor. Requires admin access.
A vulnerability in Zohocorp ManageEngine ADSelfService Plus before version 6524 allows Multi Factor Authentication (MFA) bypass. An attacker can exploit this flaw to gain unauthorized access to the system without completing additional authentication factors.
The bpost-shipping-platform WordPress plugin before version 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin.