CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 3:50 PM ET)

What this means for you

This week: 3,220 CVEs published, 240 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,220; Show in the list
Critical, last 7 days: 240; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product mozilla:firefox_mobile. Show all products

23 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2022-26486 Known exploited	Critical 9.6	An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Assigned by mozilla	Dec 21, 2022
CVE-2022-26485 Known exploited	High 8.8	Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Assigned by mozilla	Dec 21, 2022
CVE-2023-29535	Medium 6.5	Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced.	Jun 2, 2023
CVE-2023-29536	High 8.8	An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.	Jun 2, 2023
CVE-2023-29539	High 8.8	When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character.	Jun 2, 2023
CVE-2023-29548	Medium 6.5	A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.	Jun 2, 2023
CVE-2023-29550	High 8.8	Memory safety bugs present in Firefox 111 and Firefox ESR 102.9.	Jun 2, 2023
CVE-2023-25747	High 7.5	A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.	Jun 19, 2023
CVE-2026-53899	Medium 6.5	Cross-origin cookies could be leaked when opening a PDF link Assigned by mozilla	Jun 16, 2026
CVE-2026-53900	Medium 4.3	Cookie injection was possible when opening a PDF link Assigned by mozilla	Jun 16, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.