CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 10:30 UTC)

What this means for you

This week: 5,476 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,476; Show in the list
Critical, last 7 days: 358; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product mozilla:firefox_esr. Show all products

9 CVEs, showing 1 to 9

CVE	Severity	Title	Published
CVE-2016-9079 Known exploited	High 7.5	A use-after-free vulnerability in SVG Animation has been discovered. Assigned by mozilla	Jun 11, 2018
CVE-2019-11708 Known exploited	Critical 10.0	Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromise… Assigned by mozilla	Jul 23, 2019
CVE-2019-11707 Known exploited	High 8.8	A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. Assigned by mozilla	Jul 23, 2019
CVE-2019-17026 Known exploited	High 8.8	Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. Assigned by mozilla	Mar 2, 2020
CVE-2020-6820 Known exploited	High 8.1	Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Assigned by mozilla	Apr 24, 2020
CVE-2020-6819 Known exploited	High 8.1	Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. Assigned by mozilla	Apr 24, 2020
CVE-2022-26486 Known exploited	Critical 9.6	An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. Assigned by mozilla	Dec 22, 2022
CVE-2022-26485 Known exploited	High 8.8	Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Assigned by mozilla	Dec 22, 2022
CVE-2024-9680 Known exploited	Critical 9.8	An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. Assigned by mozilla	Oct 9, 2024

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.