CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
HestiaCP versions 1.2.0 through 1.9.4 have an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP header without verifying the request originated from Cloudflare.
An issue in gohttp commit 34ea51 allows attackers to perform directory traversal by supplying a crafted request.
An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via a crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].
Memory safety bugs were present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150, which could allow remote code execution. The vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Memory safety bugs present in Firefox ESR 140.10 and Firefox 150 could lead to memory corruption and potentially allow arbitrary code execution. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Memory safety bugs present in Firefox 150 showed evidence of memory corruption and could potentially be exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
Privilege escalation vulnerability in the WebRTC: Audio/Video component in Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
Privilege escalation vulnerability in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
In Firefox and Thunderbird 151, a mitigation bypass vulnerability in the DOM: Security component was fixed. An attacker could bypass security measures.
A denial-of-service vulnerability due to an invalid pointer in the Audio/Video: Web Codecs component. Fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Information disclosure vulnerability in the Graphics: WebGPU component in Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
Information disclosure vulnerability in the IP Protection component in Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
An information disclosure vulnerability exists in the DOM: Security component of Firefox and Thunderbird. This flaw was fixed in Firefox 151 and Thunderbird 151.
Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
Spoofing vulnerability in the Web Speech component of Firefox and Thunderbird. Fixed in version 151.
A vulnerability in the DOM: Security component of Firefox and Thunderbird. The issue was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Spoofing issue in WebExtensions, which was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8958 is a vulnerability related to information disclosure and sandbox escape in the Security: Process Sandboxing component. It has been fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
The vulnerability allows privilege escalation in the Enterprise Policies component. It was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
The vulnerability allows privilege escalation in the DOM: Workers component. It was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.