Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,877

Export CSV
CVE-2026-96001

Windows Bluetooth Service Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-119618

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Apache Apache Software Foundation Icing and 1 more
Products
Apache Http Server Http Server Apache Http Server and 5 more
CVE-2026-109618

RCE via OOM corruption

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS 4.0 · 9.2 Critical EPSS 100.0% KEV · Listed
Vendors
Paloaltonetworks Php Redhat and 1 more
Products
Pan-os Panorama M-200 Panorama M-300 and 20 more
CVE-2026-129356

vllm-project vllm Common Prefix single_type_kv_cache_manager.py race condition

A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 0.32.0 is able to resolve this issue. The patch is identified as e687a251bb056fa527846633f7a1b0a6c0f42374. You should upgrade the affected component.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Vllm-project
Products
Vllm
CVE-2026-124866

Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124868

Incorrect boundary conditions in the DOM: Core & HTML component

Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124869

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124870

Incorrect boundary conditions in the JavaScript: GC component

Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124872

Use-after-free in the Cycle Collector component

Use-after-free in the Cycle Collector component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124873

Invalid pointer in the DOM: Editor component

Invalid pointer in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124874

Same-origin policy bypass in the Networking: HTTP component

Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124875

Incorrect boundary conditions in the DOM: CSS Object Model component

Incorrect boundary conditions in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124895

Use-after-free in the Storage: localStorage & sessionStorage component

Use-after-free in the Storage: localStorage & sessionStorage component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124927

Site isolation issue in the Graphics: WebRender component

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124940

Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124941

Information disclosure in the Security: RLBox component

Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124944

Information disclosure in the Marionette component

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-124952

Use-after-free in the Audio/Video component

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox