Overview 2,069 matches · 0 in Waratek scope · 0 protected · 26 exploited · 14 CISA KEV · 65 public PoC · 18 EPSS ≥ 0.5
2,069matches
0in Waratek scope0.0%
0protected0.0%
26exploited1.3%
14CISA KEV0.7%
65public PoC3.1%
18EPSS ≥ 0.50.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
6
0.3%
Not applicable
2,063
99.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
2,069
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 503 / year
200413
Not applicable13
High5
Medium7
Low1
not blocked13
Working exploit published1
No public exploit12
200513
Not applicable13
High3
Medium6
Low4
not blocked13
Working exploit published1
No public exploit12
200669
Not applicable69
High32
Medium29
Low8
not blocked69
Working exploit published4
No public exploit65
200716
Not applicable16
High9
Medium6
Low1
not blocked16
Working exploit published2
Forecast only1
No public exploit13
200850
Not applicable50
High27
Medium22
Low1
not blocked50
Working exploit published1
No public exploit49
200939
Not applicable39
High23
Medium16
not blocked39
Exploited1
Working exploit published2
No public exploit36
201063
Not applicable63
Critical2
High38
Medium23
not blocked63
Exploited1
Working exploit published6
No public exploit56
201169
Not applicable69
High48
Medium19
Low2
not blocked69
Working exploit published2
No public exploit67
2012149
Not applicable149
High99
Medium48
Low2
not blocked149
Working exploit published2
No public exploit147
2013113
Outside Waratek scope1
Not applicable112
Critical6
High75
Medium32
not blocked113
Exploited4
Working exploit published3
Forecast only1
No public exploit105
201464
Outside Waratek scope2
Not applicable62
Critical9
High33
Medium21
Low1
not blocked64
Exploited2
Working exploit published2
No public exploit60
201530
Outside Waratek scope1
Not applicable29
High16
Medium13
Low1
not blocked30
Working exploit published1
Proof of concept only1
No public exploit28
201613
Not applicable13
High11
Medium2
not blocked13
Working exploit published1
No public exploit12
20171
Not applicable1
High1
not blocked1
No public exploit1
2018176
Not applicable176
Critical86
High52
Medium38
not blocked176
Exploited1
Working exploit published6
Proof of concept only1
No public exploit168
201965
Not applicable65
Critical29
High20
Medium15
Low1
not blocked65
Exploited3
Working exploit published8
Proof of concept only1
No public exploit53
202081
Not applicable81
Critical5
High43
Medium33
not blocked81
Exploited4
Working exploit published1
No public exploit76
202180
Not applicable80
Critical1
High42
Medium36
Low1
not blocked80
No public exploit80
2022116
Not applicable116
Critical13
High48
Medium55
not blocked116
Exploited7
Proof of concept only32
No public exploit77
2023102
Outside Waratek scope1
Not applicable101
Critical8
High44
Medium49
Low1
not blocked102
Exploited2
Proof of concept only22
No public exploit78
2024118
Outside Waratek scope1
Not applicable117
Critical19
High51
Medium46
Low2
not blocked118
Exploited1
Working exploit published1
Proof of concept only1
No public exploit115
2025126
Not applicable126
Critical28
High57
Medium41
not blocked126
Proof of concept only1
No public exploit125
2026503
Not applicable503
Critical182
High232
Medium89
not blocked503
Proof of concept only1
No public exploit502
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-92059 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92058 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92057 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92056 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92055 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92054 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92053 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92052 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92051 | Critical | 2026-09-15 | Not applicable | No public exploit | Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92050 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92049 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92048 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92047 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92046 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92045 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92044 | High | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92043 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92042 | High | 2026-09-15 | Not applicable | No public exploit | Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92041 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92040 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92039 | Medium | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92038 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92037 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92036 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92035 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-92034 | Critical | 2026-09-15 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92032 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92031 | Medium | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92030 | Medium | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92029 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92028 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92027 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92026 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92025 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92024 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92023 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92022 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92021 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. |
| CVE-2026-92020 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92019 | High | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92018 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92017 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92016 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92015 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92014 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16. |
| CVE-2026-92013 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92012 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92011 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92010 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92009 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92008 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92007 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92006 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92005 | Medium | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-84642 | High | 2026-09-01 | Not applicable | No public exploit | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2. |
| CVE-2026-84641 | High | 2026-09-01 | Not applicable | No public exploit | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84640 | High | 2026-09-01 | Not applicable | No public exploit | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84639 | Critical | 2026-09-01 | Not applicable | No public exploit | Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84637 | Critical | 2026-09-01 | Not applicable | No public exploit | Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2. |
| CVE-2026-84145 | High | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84144 | High | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84143 | Critical | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84142 | Critical | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84141 | Critical | 2026-09-01 | Not applicable | No public exploit | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84140 | Critical | 2026-09-01 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84139 | Critical | 2026-09-01 | Not applicable | No public exploit | Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84138 | High | 2026-09-01 | Not applicable | No public exploit | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84137 | Critical | 2026-09-01 | Not applicable | No public exploit | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84136 | Critical | 2026-09-01 | Not applicable | No public exploit | Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84134 | Critical | 2026-09-01 | Not applicable | No public exploit | Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84133 | Critical | 2026-09-01 | Not applicable | No public exploit | Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84132 | High | 2026-09-01 | Not applicable | No public exploit | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84131 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84130 | High | 2026-09-01 | Not applicable | No public exploit | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84129 | Critical | 2026-09-01 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84128 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84126 | Medium | 2026-09-01 | Not applicable | No public exploit | Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84125 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84124 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84123 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84122 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84121 | Critical | 2026-09-01 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84120 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84119 | Critical | 2026-09-01 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84118 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-75874 | Critical | 2026-08-18 | Not applicable | No public exploit | Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-74990 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74989 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154. |
| CVE-2026-74988 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74987 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74986 | Critical | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74985 | Critical | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74984 | Medium | 2026-08-18 | Not applicable | No public exploit | Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74983 | High | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74982 | High | 2026-08-18 | Not applicable | No public exploit | Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74981 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74979 | Critical | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74978 | High | 2026-08-18 | Not applicable | No public exploit | Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74977 | High | 2026-08-18 | Not applicable | No public exploit | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74976 | Medium | 2026-08-18 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |