CVE-2026-92xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

653 records · Page 7 of 7

• CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92051: Spoofing issue due to invalid pointer in the Graphics component 9.1 Critical

  Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

  Updated 2026-09-21
• CVE-2026-92050: Sandbox escape due to race condition in the XPConnect component 9.1 Critical

  Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

  Updated 2026-09-21
• CVE-2026-92049: Use-after-free in the Widget: Win32 component 8.8 High

  Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component 9.0 Critical

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92047: Privilege escalation in the Crash Reporting component 8.8 High

  Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92046: Use-after-free in the Graphics component 8.8 High

  Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component 9.6 Critical

  Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92044: Information disclosure in the Networking: HTTP component 7.5 High

  Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92042: Race condition in the DOM: Content Processes component 7.5 High

  Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92041: Mitigation bypass in the DOM: Networking component 9.1 Critical

  Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92040: Use-after-free in the JavaScript: WebAssembly component 8.8 High

  Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

  Updated 2026-09-20
• CVE-2026-92039: Mitigation bypass in the DOM: Notifications component 6.3 Medium

  Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92038: Mitigation bypass in the Remote Settings Client component 9.1 Critical

  Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92037: Incorrect boundary conditions in the DOM: Animation component 9.8 Critical

  Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

  Updated 2026-09-21
• CVE-2026-92036: Incorrect boundary conditions in the Networking: HTTP component 9.8 Critical

  Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

  Updated 2026-09-21
• CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component 9.6 Critical

  Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.

  Updated 2026-09-30
• CVE-2026-92034: Site isolation issue in the Graphics component 9.1 Critical

  Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

  Updated 2026-09-21
• CVE-2026-92033: Privilege escalation in Firefox for Android 8.8 High

  Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.

  Updated 2026-09-16
• CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component 9.6 Critical

  Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92031: Information disclosure in the Graphics: ImageLib component 6.5 Medium

  Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component 5.4 Medium

  Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92029: Use-after-free in the SVG component 8.8 High

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92028: Use-after-free in the DOM: Core & HTML component 8.8 High

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92027: Use-after-free in the DOM: Streams component 8.8 High

  Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-18
• CVE-2026-92026: Use-after-free in the Networking component 8.8 High

  Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-18
• CVE-2026-92025: Use-after-free in the DOM: Navigation component 8.8 High

  Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-18
• CVE-2026-92024: Use-after-free in the SVG component 8.8 High

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92023: Use-after-free in the XML component 8.8 High

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92022: Use-after-free in the DOM: HTML Parser component 8.8 High

  Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92021: Use-after-free in the JavaScript Engine: JIT component 8.8 High

  Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.

  Updated 2026-09-20
• CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92019: Mitigation bypass in the Remote Settings Client component 8.1 High

  Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-21
• CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component 9.6 Critical

  Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92017: Privilege escalation in the DOM: Service Workers component 8.8 High

  Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92016: Use-after-free in the Disability Access APIs component 8.8 High

  Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-20
• CVE-2026-92015: Privilege escalation in the WebExtensions component 8.8 High

  Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92014: Privilege escalation due to incorrect boundary conditions in the Graphics component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.

  Updated 2026-09-16
• CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component 8.8 High

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-16
• CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component 5.3 Medium

  Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  Updated 2026-09-17
• CVE-2026-92003: MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion 6.9 Medium

  Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model:  - API requests with no authentication key;  - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another d

  Updated 2026-09-15
• CVE-2026-92002: MISP: Authentication failure logging suppressed during Redis unavailability 5.1 Medium

  Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when

  Updated 2026-09-15
• CVE-2026-92001: Apache Sling XSS: Missing parser resource limits 6.1 Medium

  Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

  Updated 2026-09-23
• CVE-2026-92000: adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size 8.7 High

  adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

  Updated 2026-09-24

Search a CVE ID or check dependency files →