Export limit exceeded: 414015 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414015 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124869 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124868 | 2026-11-10 | 8.8 High | ||
| Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124866 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124865 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-116571 | 2 Freeswitch, Signalwire | 2 Freeswitch, Freeswitch | 2026-11-10 | 5.9 Medium |
| FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder configuration record in a fixed stack buffer by copying wire-derived SPS and PPS values without checking that their sizes and framing fit. An established H.264 call bridged toward an RTMP endpoint could supply oversized SPS and PPS parameter sets and overrun the function's stack frame. The flaw affects only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg; the module is disabled in the stock build and configuration. The corruption can abort FreeSWITCH and terminate every active call, and builds without stack protection receive a limited stack-write primitive, although code execution has not been demonstrated. This issue is fixed in version 1.11.2. | ||||
| CVE-2026-124864 | 2026-11-10 | 9.6 Critical | ||
| Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124863 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124862 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124861 | 2026-11-10 | 9.6 Critical | ||
| Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-116572 | 2 Freeswitch, Signalwire | 2 Freeswitch, Freeswitch | 2026-11-10 | 6.5 Medium |
| FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2. | ||||
| CVE-2026-124860 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124859 | 2026-11-10 | 9.6 Critical | ||
| Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124858 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124857 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124856 | 2026-11-10 | 8.8 High | ||
| Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124855 | 2026-11-10 | N/A | ||
| Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124854 | 2026-11-10 | N/A | ||
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-124853 | 2026-11-10 | 9.6 Critical | ||
| Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, and Thunderbird 160. | ||||
| CVE-2026-116780 | 2 Freeswitch, Signalwire | 2 Freeswitch, Freeswitch | 2026-11-10 | 2.7 Low |
| FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2. | ||||
| CVE-2026-116781 | 2 Freeswitch, Signalwire | 2 Freeswitch, Freeswitch | 2026-11-10 | 5.3 Medium |
| FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2. | ||||