Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

11,315 results · page 18 of 227

Oct 13, 2026Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.CVE-2026-103569 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.CVE-2026-103558 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.CVE-2026-102870 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Product
.NET 10.0 installed on Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2026-102869 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Product
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-102867 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.CVE-2026-102866 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-102865 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-102863 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-102862 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-102861 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-102860 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.CVE-2026-102858 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Product
Microsoft Office 365 for Mac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-102857 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-102856 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-102850 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-102849 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-102225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.CVE-2026-102217 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-102210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.CVE-2026-102203 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.CVE-2026-102199 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.CVE-2026-102198 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.CVE-2026-102192 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
Product
Windows Server 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.CVE-2026-102186 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.CVE-2026-100222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.CVE-2026-100220 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.CVE-2026-100219 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Product
Windows 11 version 23H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2026-100218 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.CVE-2026-100214 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
Product
Microsoft Dynamics NAV 2017
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-100212 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-100211 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-100210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-100209 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Product
Microsoft 365 Apps for Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.CVE-2026-100202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
Product
Windows 10 Version 1607
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <CVE-2026-78799 · Other software · reported by MITRECritical 9.8
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com ikuai8.com
Oct 13, 2026The network messaging layer contained improper handling of highly compressed data affecting service availability.CVE-2026-97334 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 8.7
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
Product
Commvault Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.commvault.com
Oct 13, 2026Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.CVE-2026-53420 · Other software · Zoom Communications · reported by security@zoom.usHigh 8
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.
Product
Zoom Workplace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Oct 13, 2026An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacCVE-2026-11732 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 6.3
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
Product
CAX30
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.netgear.com netgear.com
Oct 13, 2026Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credeCVE-2026-11730 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Low 2.1
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Product
EX3700
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.netgear.com netgear.com
Oct 13, 2026Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.CVE-2026-108184 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.4
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
Product
Zoom Clients
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zoom.com
Oct 13, 2026Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network CVE-2026-107918 · Network & remote access · NETGEAR · reported by a2826606-91e7-4eb6-899e-8484bd4575d5Medium 4.3
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
Product
R7300DST
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.netgear.com netgear.com
Oct 13, 2026Race condition in the Networking: DNS component.CVE-2026-109779 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.2
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Information disclosure in the WebRTC: Networking component.CVE-2026-109771 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Information disclosure in the Networking: Cache component.CVE-2026-109769 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Information disclosure in the Networking component.CVE-2026-109767 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Mitigation bypass in the Networking: HTTP component.CVE-2026-109760 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Site isolation issue in the Networking component.CVE-2026-109759 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Sandbox escape due to race condition in the Networking component.CVE-2026-109757 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.3
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Information disclosure in the Networking component.CVE-2026-109751 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026Sandbox escape due to incorrect boundary conditions in the Networking component.CVE-2026-109708 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.6
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.