CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure. This may allow remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
A use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds. This allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
A race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before version 45.0 may allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.
A race condition in libvpx in Mozilla Firefox before version 45.0 on Windows may allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before version 45.0 on Windows omits an unspecified status check, which might allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.
An integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before version 45.0 on Windows may allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact.
The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.
An integer underflow in the Brotli algorithm, used in Mozilla Firefox before version 45.0, allows remote attackers to execute arbitrary code or cause a denial of service via crafted data with Brotli compression.
The nsNPObjWrapper::GetNewOrUsed function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted NPAPI plugin.
A use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.
The FileReader class in Mozilla Firefox before version 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation.
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.
Use-after-free vulnerability in the nsHTMLDocument::SetBody function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element.
An integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by mishandling end tags.
The ServiceWorkerManager class in Mozilla Firefox before version 45.0 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified use of the Clients API.
The nsCSPContext::SendReports function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 does not prevent the use of a non-HTTP report-uri for Content Security Policy (CSP) violation reports. This allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 45.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.