CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 8:23 PM ET)

What this means for you

This week: 3,185 CVEs published, 234 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,185; Show in the list
Critical, last 7 days: 234; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product mozilla:firefox_esr. Show all products

55 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2024-9680 Known exploited	Critical 9.8	An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. Assigned by mozilla	Oct 9, 2024
CVE-2023-4052	Medium 6.5	The Firefox updater created a directory writable by non-privileged users.	Aug 1, 2023
CVE-2023-3600	High 8.8	During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash.	Jul 12, 2023
CVE-2023-37211	High 8.8	Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12.	Jul 5, 2023
CVE-2023-37208	High 7.8	When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.	Jul 5, 2023
CVE-2023-37207	Medium 6.5	A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.	Jul 5, 2023
CVE-2023-37202	High 8.8	Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free.	Jul 5, 2023
CVE-2023-34416	Critical 9.8	Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12.	Jun 19, 2023
CVE-2023-34414	Low 3.1	The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays.	Jun 19, 2023
CVE-2023-29545	Medium 6.5	Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.	Jun 19, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.