Overview 3,934 matches · 1 in Waratek scope · 0 protected · 35 exploited · 15 CISA KEV · 159 public PoC · 28 EPSS ≥ 0.5
3,934matches
1in Waratek scope0.0%
0protected0.0%
35exploited0.9%
15CISA KEV0.4%
159public PoC4.0%
28EPSS ≥ 0.50.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.0%
Outside Waratek scope
16
0.4%
Not applicable
3,917
99.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
3,934
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 592 / year
20002
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
200110
Not applicable10
High7
Medium1
Low2
not blocked10
Working exploit published2
No public exploit8
200230
Not applicable30
High16
Medium12
Low2
not blocked30
Working exploit published3
No public exploit27
200313
Not applicable13
Critical1
High3
Medium6
Low3
not blocked13
Working exploit published2
No public exploit11
200454
Outside Waratek scope1
Not applicable53
High19
Medium29
Low6
not blocked54
Working exploit published6
No public exploit48
200593
Not applicable93
High28
Medium43
Low22
not blocked93
Working exploit published11
No public exploit82
2006122
Not applicable122
High50
Medium57
Low15
not blocked122
Exploited1
Working exploit published12
No public exploit109
200787
Not applicable87
Critical1
High27
Medium57
Low2
not blocked87
Working exploit published8
Forecast only1
No public exploit78
200898
Not applicable98
High42
Medium53
Low3
not blocked98
Working exploit published7
No public exploit91
2009143
Outside Waratek scope3
Not applicable140
Critical1
High72
Medium66
Low4
not blocked143
Exploited3
Working exploit published24
No public exploit116
2010123
Not applicable123
Critical2
High62
Medium55
Low4
not blocked123
Exploited1
Working exploit published11
No public exploit111
2011117
Not applicable117
High66
Medium47
Low4
not blocked117
Working exploit published4
Proof of concept only1
No public exploit112
2012205
Not applicable205
High122
Medium78
Low5
not blocked205
Working exploit published2
Proof of concept only1
No public exploit202
2013161
Outside Waratek scope1
Not applicable160
Critical6
High93
Medium61
Low1
not blocked161
Exploited4
Working exploit published6
Forecast only1
No public exploit150
2014120
Outside Waratek scope3
Not applicable117
Critical9
High53
Medium55
Low3
not blocked120
Exploited2
Working exploit published3
No public exploit115
2015188
Outside Waratek scope2
Not applicable186
Critical1
High86
Medium94
Low7
not blocked188
Exploited2
Working exploit published3
Proof of concept only2
No public exploit181
2016142
Outside Waratek scope1
Not applicable141
Critical15
High75
Medium51
Low1
not blocked142
Working exploit published2
No public exploit140
20179
Not applicable9
Critical2
High6
Medium1
not blocked9
No public exploit9
2018358
Not applicable358
Critical120
High117
Medium119
Low2
not blocked358
Exploited1
Working exploit published9
Proof of concept only1
No public exploit347
2019146
Not applicable146
Critical41
High49
Medium55
Low1
not blocked146
Exploited5
Working exploit published8
Proof of concept only1
No public exploit132
2020179
Outside Waratek scope2
Not applicable177
Critical15
High78
Medium83
Low3
not blocked179
Exploited4
Working exploit published1
No public exploit174
2021154
Outside Waratek scope1
Not applicable153
Critical7
High66
Medium79
Low2
not blocked154
Exploited1
Proof of concept only1
No public exploit152
2022181
Not applicable181
Critical20
High75
Medium85
Low1
not blocked181
Exploited7
Proof of concept only54
No public exploit120
2023197
Outside Waratek scope1
Not applicable196
Critical20
High73
Medium102
Low2
not blocked197
Exploited2
Proof of concept only36
No public exploit159
2024202
Outside Waratek scope1
Not applicable201
Critical35
High79
Medium85
Low3
not blocked202
Exploited1
Working exploit published1
Proof of concept only5
No public exploit195
2025208
No exploit published1
Not applicable207
Critical47
High77
Medium80
Low4
not blocked208
Exploited1
Proof of concept only2
No public exploit205
2026592
Not applicable592
Critical210
High270
Medium112
not blocked592
Proof of concept only3
No public exploit589
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-92061 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92060 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92059 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92058 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92057 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92056 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92055 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92054 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92053 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92052 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92051 | Critical | 2026-09-15 | Not applicable | No public exploit | Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92050 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92049 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92048 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92047 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92046 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92045 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92044 | High | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92043 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92042 | High | 2026-09-15 | Not applicable | No public exploit | Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92041 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92040 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92039 | Medium | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92038 | Critical | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92037 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92036 | Critical | 2026-09-15 | Not applicable | No public exploit | Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92035 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-92034 | Critical | 2026-09-15 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92033 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156. |
| CVE-2026-92032 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92031 | Medium | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92030 | Medium | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92029 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92028 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92027 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92026 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92025 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92024 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92023 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92022 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92021 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. |
| CVE-2026-92020 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92019 | High | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92018 | Critical | 2026-09-15 | Not applicable | No public exploit | Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92017 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92016 | High | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92015 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92014 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16. |
| CVE-2026-92013 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92012 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92011 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92010 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92009 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92008 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92007 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92006 | High | 2026-09-15 | Not applicable | No public exploit | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92005 | Medium | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-86853 | Medium | 2026-09-08 | Not applicable | No public exploit | A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1. |
| CVE-2026-84642 | High | 2026-09-01 | Not applicable | No public exploit | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2. |
| CVE-2026-84641 | High | 2026-09-01 | Not applicable | No public exploit | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84640 | High | 2026-09-01 | Not applicable | No public exploit | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84639 | Critical | 2026-09-01 | Not applicable | No public exploit | Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84637 | Critical | 2026-09-01 | Not applicable | No public exploit | Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2. |
| CVE-2026-84145 | High | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84144 | High | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84143 | Critical | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84142 | Critical | 2026-09-01 | Not applicable | No public exploit | Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84141 | Critical | 2026-09-01 | Not applicable | No public exploit | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84140 | Critical | 2026-09-01 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84139 | Critical | 2026-09-01 | Not applicable | No public exploit | Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84138 | High | 2026-09-01 | Not applicable | No public exploit | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84137 | Critical | 2026-09-01 | Not applicable | No public exploit | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84136 | Critical | 2026-09-01 | Not applicable | No public exploit | Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84135 | Critical | 2026-09-01 | Not applicable | No public exploit | Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. |
| CVE-2026-84134 | Critical | 2026-09-01 | Not applicable | No public exploit | Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84133 | Critical | 2026-09-01 | Not applicable | No public exploit | Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84132 | High | 2026-09-01 | Not applicable | No public exploit | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84131 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84130 | High | 2026-09-01 | Not applicable | No public exploit | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84129 | Critical | 2026-09-01 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84128 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84127 | Medium | 2026-09-01 | Not applicable | No public exploit | Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155. |
| CVE-2026-84126 | Medium | 2026-09-01 | Not applicable | No public exploit | Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84125 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84124 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84123 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84122 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84121 | Critical | 2026-09-01 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84120 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84119 | Critical | 2026-09-01 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84118 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84117 | High | 2026-09-01 | Not applicable | No public exploit | Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155. |
| CVE-2026-81267 | Medium | 2026-08-31 | Not applicable | No public exploit | A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0. |
| CVE-2026-75874 | Critical | 2026-08-18 | Not applicable | No public exploit | Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-74990 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74989 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154. |
| CVE-2026-74988 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74987 | Critical | 2026-08-18 | Not applicable | No public exploit | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74986 | Critical | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74985 | Critical | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |