Export limit exceeded: 395795 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395795 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395795 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89093 | 2 Wordplus, Wordpress | 2 Better Messages – Chat Rooms, Group Chat, Private Messages & Ai Chat Bots, Wordpress | 2026-09-20 | 5.3 Medium |
| The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users. | ||||
| CVE-2026-92078 | 1 Mozilla | 1 Firefox | 2026-09-20 | 6.5 Medium |
| Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92077 | 1 Mozilla | 1 Firefox | 2026-09-20 | 6.5 Medium |
| Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92067 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92063 | 1 Mozilla | 1 Firefox | 2026-09-20 | 6.5 Medium |
| Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | ||||
| CVE-2026-92060 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92058 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92056 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92049 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92046 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92042 | 1 Mozilla | 1 Firefox | 2026-09-20 | 7.5 High |
| Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92040 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | ||||
| CVE-2026-92029 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92028 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92024 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92023 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92022 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92021 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. | ||||
| CVE-2026-92018 | 1 Mozilla | 1 Firefox | 2026-09-20 | 9.6 Critical |
| Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92016 | 1 Mozilla | 1 Firefox | 2026-09-20 | 8.8 High |
| Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||