← Back

Mozilla

mozilla

3,934 CVEs • 44 products

Products (44)

Click to collapse
Toggle
Firefox
firefox
3,473 CVEs
Thunderbird
thunderbird
2,068 CVEs
Seamonkey
seamonkey
704 CVEs
Firefox Esr
firefox_esr
487 CVEs
Thunderbird Esr
thunderbird_esr
228 CVEs
Bugzilla
bugzilla
145 CVEs
Mozilla
mozilla
108 CVEs
Firefox Mobile
firefox_mobile
87 CVEs
Network Security Services
network_security_services
50 CVEs
Mozilla Suite
mozilla_suite
27 CVEs
Firefox Focus
firefox_focus
20 CVEs
Focus
focus
16 CVEs
Firefox Os
firefox_os
14 CVEs
Nss
nss
6 CVEs
Bleach
bleach
5 CVEs
Bonsai
bonsai
4 CVEs
Camino
camino
4 CVEs
Vpn
vpn
4 CVEs
Netscape Portable Runtime
netscape_portable_runtime
3 CVEs
Convict
convict
3 CVEs
Nunjucks
nunjucks
2 CVEs
Mozjpeg
mozjpeg
2 CVEs
Webthings Gateway
webthings_gateway
2 CVEs
Pollbot
pollbot
2 CVEs
Geckodriver
geckodriver
2 CVEs
Gecko
gecko
1 CVE
Durian Web Application Server
durian_web_application_server
1 CVE
Geckb
geckb
1 CVE
Libxul
libxul
1 CVE
Zamboni
zamboni
1 CVE
Firefoxos
firefoxos
1 CVE
Persona
persona
1 CVE
Hubs Cloud Reticulum
hubs_cloud_reticulum
1 CVE
Hubs Cloud
hubs_cloud
1 CVE
Mozilla Vpn
mozilla_vpn
1 CVE
Nss Esr
nss_esr
1 CVE
Hawk
hawk
1 CVE
Common Voice
common_voice
1 CVE
Sccache
sccache
1 CVE
Neqo
neqo
1 CVE
Rhino
rhino
1 CVE
0din Scanner
0din_scanner
1 CVE
Thin Vec
thin-vec
1 CVE
Klar
klar
1 CVE

CVEs (3,934)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-16364
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16363
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16362
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16361
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vul...Show more
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.Show less
CVE-2026-16360
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbi...Show more
Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.Show less
CVE-2026-16359
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16358
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16357
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16356
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16355
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16354
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16353
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16352
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16351
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16350
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16349
1Mozilla
2Firefox
Thunderbird
Oct 24, 2026
Jul 21, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-15719
1Mozilla
1Firefox
Jul 22, 2026
Jul 14, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunde...Show more
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.Show less
CVE-2026-15718
1Mozilla
1Firefox
Jul 22, 2026
Jul 14, 2026
N/A· v4
4.3 MEDIUM· v3
N/A· v2
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.
CVE-2026-14906
1Mozilla
1Firefox Mobile
Oct 24, 2026
Jul 13, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.
CVE-2026-13356
1Mozilla
1Firefox
Oct 25, 2026
Jul 7, 2026
N/A· v4
6.3 MEDIUM· v3
N/A· v2
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-contr...Show more
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.Show less