CVE Vulnerability Catalog

Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Firefox ESR 140.12 and Thunderbird 152 and 140.12.

A memory safety bug was fixed in Firefox 152 and Thunderbird 152. This vulnerability was also patched in the ESR versions of both Firefox and Thunderbird.

A memory safety bug was fixed in Firefox 152 and Thunderbird 152. This vulnerability was also patched in the ESR versions of Firefox and Thunderbird.

CVE-2026-12303 is an information disclosure vulnerability due to incorrect boundary conditions in the Graphics: WebGPU component. It was fixed in Firefox 152 and Thunderbird 152.

The vulnerability involves a mitigation bypass in the DOM security component. It was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Thunderbird 152.

A JIT miscompilation vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

A memory safety bug was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. This vulnerability could potentially allow remote code execution or data leakage.

CVE-2026-8484 describes a heap buffer overflow vulnerability in the Jansi JNI 'ioctl()' wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes (DoS).

A format string vulnerability has been found in the 'alias' parameter of the Serial Param configuration page in NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This issue arises from insufficient input validation and improper handling of externally supplied format strings.

There is an unauthenticated sensitive data exposure vulnerability in GetGenie versions <= 4.4.1.

Versions of Envira Photo Gallery up to 1.12.5 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.

The SEO Plugin by Squirrly SEO in versions up to 12.4.16 has a vulnerability in access control that allows unauthorized access.

A missing authorization vulnerability in Rara Themes Metro Magazine allows exploiting incorrectly configured access control security levels.

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the `ajax_pay_for_order()` function. This affects all versions up to and including 10.7.0, where there is no verification of order ownership or order_key when processing payment.

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'fldr_ttl' parameter in all versions up to and including 2.1.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to and including 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function.

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 2.0.7. This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data.