NVD disclosure day
CVE-2026-2807
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety bugs in Firefox and Thunderbird could allow arbitrary code execution if exploited. These vulnerabilities have been addressed in updated versions of the software.
CVE-2026-2799
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird could allow an attacker to execute arbitrary code. This vulnerability is reachable via malicious websites or specially crafted emails, potentially leading to system compromise. Users should ensure their software is updated.
CVE-2026-2797
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the JavaScript garbage collection component of Firefox and Thunderbird could allow for significant compromise if exploited. This could occur when processing specific web content or emails, potentially leading to application crashes or other unintended behavior that impacts availability
CVE-2026-2796
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in the JavaScript WebAssembly component of Mozilla Firefox and Thunderbird could allow attackers to compromise affected systems if users interact with malicious web content. The flaw involves Just-In-Time miscompilation, and while exploitation requires user interaction, the potential impact on
CVE-2026-2795
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the JavaScript garbage collection component of Firefox and Thunderbird could allow an attacker to execute arbitrary code by tricking a user into visiting a malicious website or opening a crafted file. This could impact the confidentiality, integrity, and availability of data on affecte
CVE-2026-2793
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety flaws in Firefox and Thunderbird could allow arbitrary code execution if reachable, potentially impacting data integrity and confidentiality. While exploitation is presumed difficult, the widespread use of these applications necessitates confirming their presence and relevance within the organization to a
CVE-2026-2792
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Memory safety vulnerabilities in Firefox and Thunderbird have been identified, with evidence of memory corruption that could allow for arbitrary code execution if reached. This impacts the integrity and availability of these applications when exposed.
CVE-2026-2778
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical sandbox escape vulnerability exists in the DOM: Core & HTML component of Firefox and Thunderbird. This issue could allow attackers to bypass security boundaries when processing specific web content, potentially impacting data integrity and system operations. Confirmation of affected browsers is necessary to
CVE-2026-2777
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical privilege escalation vulnerability exists in the Messaging System component of Mozilla Firefox and Thunderbird, potentially allowing unauthorized access to elevate privileges. While the advisory does not specify the exact impact on data, this could lead to system compromise if exploited remotely. Confirmatio
CVE-2026-2776
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A sandbox escape vulnerability in the Telemetry component of External Software could allow attackers to break out of the intended environment. If reachable, this could potentially lead to unauthorized access to system resources or sensitive data, impacting confidentiality, integrity, or availability. Understanding the
CVE-2026-2775
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in the DOM's HTML parser for Firefox and Thunderbird allows for mitigation bypass, potentially impacting confidentiality, integrity, and availability. Attackers could exploit this by luring users to malicious websites or emails, leading to full application compromise. The primary concern is con
CVE-2026-2774
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An integer overflow in the Audio/Video component of Firefox and Thunderbird could allow an attacker to compromise confidentiality, integrity, and availability. This vulnerability is network-exploitable, but its impact is mainly confined to the end-user's local environment.
CVE-2026-2773
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
Incorrect boundary conditions in the Web Audio component of Firefox and Thunderbird could allow an unauthenticated network attacker to compromise confidentiality, integrity, and availability. This vulnerability might be exploited if users interact with malicious web content. The scope of impact is uncertain, but it cou
CVE-2026-2772
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the Audio/Video playback component of Firefox and Thunderbird could permit an attacker to execute arbitrary code. This vulnerability may be triggered by processing malicious media content, potentially impacting system integrity.
CVE-2026-2771
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in the DOM: Core & HTML component of Firefox and Thunderbird, potentially allowing for significant compromise if reached. The issue arises from undefined behavior, which could lead to manipulation of web content and sensitive information. Readers should care because this impacts widely u
CVE-2026-2770
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the DOM Bindings component of Firefox and Thunderbird could allow for arbitrary code execution if reachable. This means an attacker could potentially compromise the integrity and confidentiality of the application through malicious web content. This vulnerability has been addressed in
CVE-2026-2768
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical sandbox escape vulnerability exists in the Storage: IndexedDB component of Firefox and Thunderbird. If reachable, an attacker could exploit this to break out of the application's sandbox, potentially leading to system compromise. This affects user and system data and requires verification of usage on endpoin
CVE-2026-2767
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the WebAssembly component of Firefox and Thunderbird could allow an attacker to execute arbitrary code by processing malicious web content or email. This impacts application integrity and availability.
CVE-2026-2766
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical use-after-free vulnerability in the JavaScript engine of Firefox and Thunderbird could allow attackers to execute arbitrary code if a user interacts with malicious content. This poses a significant risk to affected systems, as it could lead to unauthorized access and data manipulation.
CVE-2026-2765
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability exists in the JavaScript Engine of Mozilla Firefox and Thunderbird. This flaw could permit an attacker to execute arbitrary code by processing malicious web content or data. While classified as critical, its actual impact and relevance depend on whether these applications are used and acc
CVE-2026-2764
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the JavaScript Engine's JIT component affects Firefox and Thunderbird. If exploited, this could enable an attacker to execute arbitrary code, potentially compromising user systems. This vulnerability is network-exploitable and relevant to any user interacting with malicious content via
CVE-2026-2763
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical use-after-free vulnerability exists in the JavaScript Engine of Firefox and Thunderbird. This flaw could allow an attacker to execute arbitrary code by processing malicious content, potentially leading to system compromise.
CVE-2026-2762
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An integer overflow in the JavaScript Standard Library component of Firefox and Thunderbird could allow an attacker to execute arbitrary code by processing specially crafted JavaScript. This vulnerability is reachable via the network, impacting application integrity and potentially leading to system compromise.
CVE-2026-2761
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical sandbox escape vulnerability exists in the Graphics: WebRender component of Mozilla's Firefox and Thunderbird applications. This could allow an attacker to bypass security restrictions and potentially compromise the affected system. It is important to determine if these applications and their affected versio
CVE-2026-2760
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability in Mozilla's Graphics: WebRender component could allow an attacker to escape the application's sandbox. This could lead to unauthorized code execution and potential system compromise. This issue is present in Firefox and Thunderbird.
CVE-2026-2759
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical vulnerability exists in the Graphics: ImageLib component of Firefox and Thunderbird, potentially allowing for significant security impacts if reachable. This flaw in image processing could lead to code execution or other system compromises when vulnerable applications process specially crafted image data. Un
CVE-2026-2758
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A use-after-free vulnerability in the JavaScript garbage collection component of Firefox and Thunderbird could allow for arbitrary code execution if reachable. This could lead to a compromise of confidentiality, integrity, and availability, depending on the application's privileges.
CVE-2026-2757
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A critical flaw in Firefox and Thunderbird's WebRTC component could allow an attacker to compromise confidentiality, integrity, and availability by sending specially crafted network data, impacting how audio and video are processed.
CVE-2026-25968
Halo Surface Signal: 3 out of 5 — possibly public-facing.
ImageMagick, a widely used image processing tool, has a stack buffer overflow vulnerability. If reachable, processing a specially crafted image file could lead to memory corruption, potentially allowing for code execution. This is relevant for systems processing untrusted image inputs.