97
CVEs
29
Critical
38
High
0
KEV
3
PoC
5
Unpatched C/H
90.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
29
HIGH
38
MEDIUM
30
LOW
0
Monthly CVE Trend
Affected Products (30)
Firefox
1621
Thunderbird
1007
Firefox Esr
462
Ubuntu Linux
371
Opensuse
325
Seamonkey
317
Android
288
Debian Linux
268
Thunderbird Esr
226
Enterprise Linux Workstation
169
Enterprise Linux Desktop
169
Enterprise Linux Server
168
Linux Enterprise Desktop
127
Linux Enterprise Server
126
Enterprise Linux Eus
116
Leap
110
Enterprise Linux Server Aus
105
Linux Enterprise Software Development Kit
102
Enterprise Linux Server Eus
95
Fedora
77
Enterprise Linux Server Tus
70
Solaris
68
Suse Linux Enterprise Server
56
Chrome
51
Suse Linux Enterprise Desktop
45
Suse Linux Enterprise Software Development Kit
45
Open Redirect
33
Network Security Services
33
Bugzilla
31
Linux Enterprise
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-90648 | Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present. | HIGH | 7.1 | – | 56 |
PoC
No patch
|
| CVE-2026-55593 | Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-75874 | Sandbox escape in the Remote Settings Client component of Mozilla Firefox lets attacker-controlled code break out of the isolated content process and reach the more privileged parent process, and was resolved in Firefox 154. The flaw is classed as a protection-mechanism failure (CWE-693) and carries a maximal CVSS 3.1 base score of 10.0 with a changed scope, reflecting cross-boundary impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a high-severity but not yet actively-exploited issue. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-74990 | Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1. | CRITICAL | 9.8 | 0.6% | 50 |
|
| CVE-2026-74979 | Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-74943 | Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-74987 | Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-84143 | Memory corruption in Mozilla Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14 stems from a batch of internally discovered memory-safety defects that Mozilla presumes could be exploited to run arbitrary code within the browser process. The flaws were found by Mozilla's own developers and fuzzing efforts (no external report), affect the mainline and both ESR trains, and are resolved in Firefox 155, ESR 140.15, and ESR 153.2. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-74940 | Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-74964 | Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-74944 | Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-74936 | Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-74988 | Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-84637 | Arbitrary code execution in Mozilla Thunderbird before 154 (and before ESR 153.2) on Windows allows a crafted calendar (iCalendar) invitation to attach a file:// URI that points at a local or network-hosted executable, bypassing Thunderbird's normal blocking of executable attachments. When the new invitation display is enabled the attachment can also be shown under a misleading, benign-looking filename. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.15% (5th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-74985 | Privilege escalation in Mozilla Firefox's Enterprise Policies component allows an attacker to gain elevated privileges by subverting administrator-defined policy enforcement, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla (the reporter) assigned CWE-269 (Improper Privilege Management) and the record carries a CVSS 9.8 rating, though the low EPSS score (0.15%, 5th percentile) signals minimal predicted exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.1% | 49 |
|