CVE-2026-5735

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2026
Last modified
Oct 23, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-573507.1Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.CVE-2026-573517.1Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.CVE-2026-573524.8Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.CVE-2026-573536.5Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.CVE-2026-573546.5Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.CVE-2026-573556.5Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.CVE-2026-573567.1Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.CVE-2026-573577.1Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.CVE-2026-573587.1Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.CVE-2026-573597.1Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.CVE-2026-57367.3A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-stCVE-2026-573607.1Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.