https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:18:54.009948+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:2883 ALSA-2024:2883 — Important: firefox security update 2026-10-02T23:18:54.742464+00:00

Affected: AlmaLinux:9: firefox, AlmaLinux:9: firefox-x11

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.11.0 ESR.

Security Fix(es):

* firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * firefox: IndexedDB files retained in private browsing mode (CVE-2024-4767) * firefox: Potential permissions request bypass via clickjacking (CVE-2024-4768) * firefox: Cross-origin responses could be distinguished between script and non-script content-types (CVE-2024-4769) * firefox: Use-after-free could occur when printing to PDF (CVE-2024-4770) * firefox: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11 (CVE-2024-4777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-04733 bdu:2024-04733 2026-10-02T23:18:54.742547+00:00 bdu:2024-04733 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0396 certfr-2024-avi-0396 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta… 2026-10-02T23:18:54.742566+00:00 certfr-2024-avi-0396 https://cve.radiocsirt.org/vuln/cnvd-2024-23340 cnvd-2024-23340 2026-10-02T23:18:54.742582+00:00 cnvd-2024-23340 https://cve.radiocsirt.org/vuln/euvd-2026-316920 EUVD-2026-316920 2026-10-02T23:18:54.742595+00:00 EUVD-2026-316920 https://cve.radiocsirt.org/vuln/fkie_cve-2024-4367 fkie_cve-2024-4367 2026-10-02T23:18:54.742606+00:00

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

 https://cve.radiocsirt.org/vuln/ghsa-wgrm-67xf-hhpq GHSA-wgrm-67xf-hhpq — PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF 2026-10-02T23:18:54.742628+00:00

Affected: npm: pdfjs-dist

### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015

### Workarounds Set the option `isEvalSupported` to `false`.

### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

 https://cve.radiocsirt.org/vuln/icsa-26-134-04 ICSA-26-134-04 — Siemens Teamcenter 2026-10-02T23:18:54.742653+00:00

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page. The affected application contains hardcoded key which is used for obfuscation stored directly into the application. This could allow an attacker to obtain these keys and misuse them to gain unauthorized access.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0147 NCSC-2026-0147 — Kwetsbaarheden verholpen in Siemens-producten 2026-10-02T23:18:54.742677+00:00 NCSC-2026-0147 https://cve.radiocsirt.org/vuln/oesa-2024-2523 OESA-2024-2523 — firefox security update 2026-10-02T23:18:54.742969+00:00

Affected: openEuler:24.03-LTS: firefox

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fix(es):Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es): An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox &lt; 133, Firefox ESR &lt; 128.5, Thunderbird &lt; 133, and Thunderbird &lt; 128.5.(CVE-2024-11692) Enhanced Tracking Protection&apos;s Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox &lt; 133, Firefox ESR &lt; 128.5, Firefox ESR &lt; 115.18, Thunderbird &lt; 133, and Thunderbird &lt; 128.5.(CVE-2024-11694) A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox &lt; 133, Firefox ESR &lt; 128.5, Thunderbird &lt; 133, and Thunderbird &lt; 128.5.(CVE-2024-11695) The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13980-1 openSUSE-SU-2024:13980-1 — MozillaFirefox-126.0-1.1 on GA media 2026-10-02T23:18:54.743008+00:00

MozillaFirefox-126.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/oxas-adv-2024-0004 OXAS-ADV-2024-0004 — OX App Suite Security Advisory OXAS-ADV-2024-0004 2026-10-02T23:18:54.743035+00:00 OXAS-ADV-2024-0004 https://cve.radiocsirt.org/vuln/rhsa-2024:2882 RHSA-2024:2882 — Red Hat Security Advisory: firefox security update 2026-10-02T23:18:54.743049+00:00

Mozilla: Arbitrary JavaScript execution in PDF.js Mozilla: IndexedDB files retained in private browsing mode Mozilla: Potential permissions request bypass via clickjacking Mozilla: Cross-origin responses could be distinguished between script and non-script content-types Mozilla: Use-after-free could occur when printing to PDF Mozilla: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11

 https://cve.radiocsirt.org/vuln/rlsa-2026:42062 RLSA-2026:42062 — Important: webkit2gtk3 security update 2026-10-02T23:18:54.743075+00:00

Affected: Rocky Linux:9: webkit2gtk3

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699)

* webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701)

* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712)

* webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)

* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716)

* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720)

* webkitgtk: webkitgtk: A malicious websi…

 https://cve.radiocsirt.org/vuln/ssa-827383 SSA-827383 — SSA-827383: Multiple Vulnerabilities in Teamcenter 2026-10-02T23:18:54.743118+00:00

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page. The affected application contains hardcoded key which is used for obfuscation stored directly into the application. This could allow an attacker to obtain these keys and misuse them to gain unauthorized access.

 https://cve.radiocsirt.org/vuln/suse-su-2024:1676-1 SUSE-SU-2024:1676-1 — Security update for MozillaFirefox 2026-10-02T23:18:54.743141+00:00

Security update for MozillaFirefox

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-4367 UBUNTU-CVE-2024-4367 2026-10-02T23:18:54.743162+00:00

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: thunderbird, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird and 1 more

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1151 WID-SEC-W-2024-1151 — Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen 2026-10-02T23:18:54.743196+00:00

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.