CVE-2026-97711: Improper Neutralization of Input During Web Page Generation

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

PT-2026-102562

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description An invalid pointer issue exists within the JavaScript: WebAssembly component. WebAssembly is a...

PT-2026-102570

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a memory corruption flaw that occurs when an application continues to use a...

PT-2026-102599

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the JIT Just-In-Time component of the JavaScript Engine. A use-after-free occurs when an...

PT-2026-102550

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102588

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description Incorrect boundary conditions exist within the JIT Just-In-Time component of the JavaScript Engine. JIT is a method of improving...

PT-2026-102539

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a memory corruption flaw that occurs when...

PT-2026-102587

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An invalid pointer issue exists within the Just-In-Time JIT component of the JavaScript Engine. JIT is a method of improving program performance by compiling code duri...

PT-2026-102543

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102567

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An issue exists in the JavaScript Engine component involving JIT Just-In-Time miscompilation. JIT is a method of improving program performance by compiling code during...

PT-2026-102591

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An issue exists within the JavaScript: WebAssembly component. WebAssembly is a binary instruction format for a stack-based virtual machine, designed as a portable...

CVE-2026-100776: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

PT-2026-102671

Name of the Vulnerable Software and Affected Versions serialize-javascript versions 7.1.1 through 7.1.1 Description serialize-javascript converts JavaScript values into a JSON superset that includes functions and regular expressions. A flaw exists where function values are not fully protected...

CVE-2026-100769: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

PT-2026-102423

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62 Description Stored cross-site scripting exists in the IMAP OAuth connector. The issue occurs because MIME-encoded email subjects are double-decoded after HTML escaping. Unauthenticated attackers can send crafte...

A Function-Level Dataset of Vulnerable and Fixed Source Code in JavaScript and TypeScript

JavaScript and TypeScript are widely used in modern web development, making their security critical; however, automated vulnerability detection is often constrained by the availability of high-quality training data. Here we present JsVul, a dataset curated from seven major sources. Unlike generic...

PT-2026-108413

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions...

CVE-2026-100814: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

PT-2026-102444

Name of the Vulnerable Software and Affected Versions pbkdf2 versions prior to 3.1.7 Description The JavaScript fallback in lib/sync.js re-hashes passwords that exceed the digest's block size 64 bytes, or 128 bytes for sha384 and sha512 during every iteration. This occurs because the password is...

CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...