cve.bz

New CVEs this week, the last 7 days, newest first, page 73

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. –CVE-2026-86532EPSS 0.2%

    The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. …

  2. 5.7CVE-2026-123082EPSS 0.1%

    Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before log…

  3. 6.5CVE-2026-121885EPSS 0.4%

    A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system …

  4. 7.0CVE-2026-114359EPSS 0.2%

    Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an ar…

  5. 7.7CVE-2026-113422EPSS 0.4%

    In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update t…

  6. –CVE-2026-111264EPSS 0.3%

    The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are …

  7. –CVE-2026-111263EPSS 0.2%

    Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operati…

  8. –CVE-2026-111262EPSS 0.2%

    The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribu…

  9. 9.1CVE-2026-82509EPSS 0.2%

    V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default fa…

  10. 8.7CVE-2026-12708EPSS 0.4%

    Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-…

  11. 8.8CVE-2026-124952EPSS 0.3%

    Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.

  12. 8.8CVE-2026-124951EPSS 0.2%

    Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  13. –CVE-2026-124950EPSS 0.2%

    Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  14. –CVE-2026-124949EPSS 0.2%

    Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  15. 8.8CVE-2026-124948EPSS 0.3%

    Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  16. 8.8CVE-2026-124947EPSS 0.3%

    Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  17. –CVE-2026-124946EPSS 0.2%

    Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  18. –CVE-2026-124945EPSS 0.2%

    Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  19. 4.3CVE-2026-124944EPSS 0.3%

    Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  20. 8.8CVE-2026-124943EPSS 0.3%

    Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  21. –CVE-2026-124942EPSS 0.2%

    Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  22. 4.3CVE-2026-124941EPSS 0.3%

    Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  23. –CVE-2026-124940EPSS 0.2%

    Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  24. –CVE-2026-124939EPSS 0.2%

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  25. –CVE-2026-124938EPSS 0.2%

    Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  26. –CVE-2026-124937EPSS 0.1%

    Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.

  27. –CVE-2026-124936EPSS 0.2%

    Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  28. –CVE-2026-124935EPSS 0.2%

    Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  29. –CVE-2026-124934EPSS 0.2%

    Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  30. –CVE-2026-124933EPSS 0.2%

    Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  31. 8.8CVE-2026-124932EPSS 0.3%

    Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  32. –CVE-2026-124931EPSS 0.2%

    Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  33. 4.3CVE-2026-124930EPSS 0.3%

    Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  34. 4.3CVE-2026-124929EPSS 0.3%

    Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  35. –CVE-2026-124928EPSS 0.2%

    Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  36. –CVE-2026-124927EPSS 0.2%

    Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  37. 8.8CVE-2026-124926EPSS 0.3%

    Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  38. 4.3CVE-2026-124925EPSS 0.3%

    Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  39. 8.8CVE-2026-124924EPSS 0.3%

    Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  40. –CVE-2026-124923EPSS 0.2%

    Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  41. 8.8CVE-2026-124922EPSS 0.3%

    Use-after-free in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  42. –CVE-2026-124921EPSS 0.2%

    Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  43. –CVE-2026-124920EPSS 0.2%

    Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

  44. 8.8CVE-2026-124919EPSS 0.3%

    Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  45. 8.8CVE-2026-124918EPSS 0.3%

    Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  46. 9.6CVE-2026-124917EPSS 0.3%

    Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  47. 8.8CVE-2026-124915EPSS 0.3%

    Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  48. –CVE-2026-124914EPSS 0.2%

    Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  49. –CVE-2026-124913EPSS 0.2%

    Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  50. –CVE-2026-124912EPSS 0.2%

    Spoofing issue in the DOM: Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.