Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2970▼ 106 respecto a la semana anterior
Críticas / altas1447▲ 86 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior
2030 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Analizada | Crítica (9.6) | 0.32% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 5/10/2026 | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.32% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 5/10/2026 | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.33% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |
| Analizada | Crítica (9.6) | 0.35% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.34% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.34% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.33% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |
| Analizada | Alta (8.1) | 0.33% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Crítica (9.6) | 0.34% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.33% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |
| Analizada | Alta (8.8) | 0.30% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| Analizada | Alta (8.8) | 0.34% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Alta (8.1) | 0.33% | — | Mozilla FirefoxMozilla Thunderbird | 29/9/2026 | 6/10/2026 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |
| Analizada | Crítica (9.1) | 0.63% | — | Mozilla Thunderbird | 15/9/2026 | 24/9/2026 | A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |
| Analizada | Alta (8.1) | 0.41% | — | Mozilla Thunderbird | 15/9/2026 | 24/9/2026 | A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |
| Analizada | Crítica (9.8) | 0.54% | — | Mozilla Thunderbird | 15/9/2026 | 24/9/2026 | A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |
| Analizada | Crítica (9.1) | 0.25% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Media (6.5) | 0.22% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Media (6.5) | 0.27% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Alta (8.8) | 0.11% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Crítica (9.1) | 0.32% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Alta (8.8) | 0.11% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Alta (8.8) | 0.22% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Alta (8) | 0.22% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | |
| Analizada | Crítica (9.6) | 0.24% | — | Mozilla FirefoxMozilla Thunderbird | 15/9/2026 | 5/10/2026 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |