Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

Flaw: Denial of service
Affects: Browser & mail

1 CVEs · updated 2026-11-14 04:39 UTC

CVE-2019-11707
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

exploited Denial of service Browser & mail Mozilla Firefox

8.8 HIGH 38% exploit odds Fix listed 2019-07-23 14:15 UTC

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.