CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 4:30 AM ET)

What this means for you

This week: 3,084 CVEs published, 231 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,084; Show in the list
Critical, last 7 days: 231; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product mozilla:firefox_esr. Show all products

55 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2016-9079 Known exploited	High 7.5	A use-after-free vulnerability in SVG Animation has been discovered. Assigned by mozilla	Jun 11, 2018
CVE-2019-11708 Known exploited	Critical 10.0	Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromise… Assigned by mozilla	Jul 23, 2019
CVE-2019-11707 Known exploited	High 8.8	A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. Assigned by mozilla	Jul 23, 2019
CVE-2019-17026 Known exploited	High 8.8	Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. Assigned by mozilla	Mar 1, 2020
CVE-2020-6820 Known exploited	High 8.1	Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Assigned by mozilla	Apr 24, 2020
CVE-2020-6819 Known exploited	High 8.1	Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. Assigned by mozilla	Apr 24, 2020
CVE-2022-26486 Known exploited	Critical 9.6	An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Assigned by mozilla	Dec 21, 2022
CVE-2022-26485 Known exploited	High 8.8	Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Assigned by mozilla	Dec 21, 2022
CVE-2023-0767	High 8.8	An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.	Jun 2, 2023
CVE-2023-1945	Medium 6.5	Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.	Jun 2, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.