Overview 3,552 matches · 0 in Waratek scope · 0 protected · 34 exploited · 15 CISA KEV · 137 public PoC · 27 EPSS ≥ 0.5
3,552matches
0in Waratek scope0.0%
0protected0.0%
34exploited1.0%
15CISA KEV0.4%
137public PoC3.9%
27EPSS ≥ 0.50.8%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
12
0.3%
Not applicable
3,540
99.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
3,552
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 574 / year
20031
Not applicable1
Medium1
not blocked1
No public exploit1
200420
Not applicable20
High8
Medium10
Low2
not blocked20
Working exploit published4
No public exploit16
200574
Not applicable74
High23
Medium32
Low19
not blocked74
Working exploit published11
No public exploit63
2006103
Not applicable103
High45
Medium48
Low10
not blocked103
Exploited1
Working exploit published8
No public exploit94
200776
Not applicable76
High23
Medium51
Low2
not blocked76
Working exploit published8
Forecast only1
No public exploit67
200892
Not applicable92
High39
Medium51
Low2
not blocked92
Working exploit published7
No public exploit85
2009125
Outside Waratek scope3
Not applicable122
High67
Medium55
Low3
not blocked125
Exploited2
Working exploit published24
No public exploit99
2010108
Not applicable108
Critical2
High61
Medium44
Low1
not blocked108
Exploited1
Working exploit published11
No public exploit96
2011102
Not applicable102
High65
Medium35
Low2
not blocked102
Working exploit published4
Proof of concept only1
No public exploit97
2012187
Not applicable187
High122
Medium60
Low5
not blocked187
Working exploit published2
Proof of concept only1
No public exploit184
2013150
Outside Waratek scope1
Not applicable149
Critical6
High91
Medium52
Low1
not blocked150
Exploited4
Working exploit published4
Forecast only1
No public exploit141
2014110
Outside Waratek scope3
Not applicable107
Critical9
High51
Medium47
Low3
not blocked110
Exploited2
Working exploit published2
No public exploit106
2015184
Outside Waratek scope2
Not applicable182
Critical1
High85
Medium91
Low7
not blocked184
Exploited2
Working exploit published3
Proof of concept only2
No public exploit177
2016139
Outside Waratek scope1
Not applicable138
Critical15
High74
Medium50
not blocked139
Working exploit published2
No public exploit137
20172
Not applicable2
Critical1
High1
not blocked2
No public exploit2
2018340
Not applicable340
Critical119
High114
Medium105
Low2
not blocked340
Exploited1
Working exploit published9
Proof of concept only1
No public exploit329
2019132
Not applicable132
Critical37
High44
Medium50
Low1
not blocked132
Exploited5
Working exploit published4
Proof of concept only1
No public exploit122
2020161
Not applicable161
Critical14
High71
Medium73
Low3
not blocked161
Exploited4
Working exploit published1
No public exploit156
2021137
Not applicable137
Critical3
High62
Medium71
Low1
not blocked137
Exploited1
Proof of concept only1
No public exploit135
2022161
Not applicable161
Critical18
High66
Medium76
Low1
not blocked161
Exploited7
Proof of concept only53
No public exploit101
2023185
Outside Waratek scope1
Not applicable184
Critical19
High71
Medium93
Low2
not blocked185
Exploited2
Proof of concept only32
No public exploit151
2024196
Outside Waratek scope1
Not applicable195
Critical35
High76
Medium82
Low3
not blocked196
Exploited1
Working exploit published1
Proof of concept only2
No public exploit192
2025193
Not applicable193
Critical47
High72
Medium71
Low3
not blocked193
Exploited1
Proof of concept only2
No public exploit190
2026574
Not applicable574
Critical205
High262
Medium107
not blocked574
Proof of concept only2
No public exploit572
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-74975 | Medium | 2026-08-18 | Not applicable | No public exploit | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. |
| CVE-2026-74974 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74973 | Medium | 2026-08-18 | Not applicable | No public exploit | Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74972 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74971 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74970 | Medium | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74969 | High | 2026-08-18 | Not applicable | No public exploit | Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74968 | Medium | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74967 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74966 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74965 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74964 | Critical | 2026-08-18 | Not applicable | No public exploit | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74963 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74962 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74961 | Critical | 2026-08-18 | Not applicable | No public exploit | Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74960 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74959 | Critical | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74958 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74957 | High | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74956 | Critical | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74955 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74954 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74953 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74952 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2. |
| CVE-2026-74951 | Medium | 2026-08-18 | Not applicable | No public exploit | Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. |
| CVE-2026-74950 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74949 | High | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74948 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74947 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74946 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74945 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74944 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74943 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74942 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74941 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74940 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74939 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74938 | Critical | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74937 | High | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74936 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74935 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74934 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-16412 | Critical | 2026-07-21 | Not applicable | No public exploit | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16411 | Critical | 2026-07-21 | Not applicable | No public exploit | Memory safety bugs present in Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16410 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16409 | High | 2026-07-21 | Not applicable | No public exploit | Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16408 | Critical | 2026-07-21 | Not applicable | No public exploit | Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16407 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16406 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16405 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16404 | High | 2026-07-21 | Not applicable | No public exploit | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. |
| CVE-2026-16403 | Medium | 2026-07-21 | Not applicable | No public exploit | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16402 | Critical | 2026-07-21 | Not applicable | No public exploit | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16401 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16400 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16399 | High | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16398 | High | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16397 | Medium | 2026-07-21 | Not applicable | No public exploit | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
| CVE-2026-16396 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16395 | Critical | 2026-07-21 | Not applicable | No public exploit | Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16394 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16393 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16392 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16391 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16390 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16389 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16388 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16387 | Critical | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16386 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16385 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16384 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16383 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16382 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16381 | Critical | 2026-07-21 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16380 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16379 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16378 | High | 2026-07-21 | Not applicable | No public exploit | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16377 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16376 | High | 2026-07-21 | Not applicable | No public exploit | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16375 | Critical | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16374 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16373 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
| CVE-2026-16372 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16371 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15. |
| CVE-2026-16370 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16369 | Critical | 2026-07-21 | Not applicable | No public exploit | Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16368 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16367 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16366 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16365 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15. |
| CVE-2026-16364 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16363 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16362 | High | 2026-07-21 | Not applicable | No public exploit | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16361 | Critical | 2026-07-21 | Not applicable | No public exploit | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. |
| CVE-2026-16360 | Critical | 2026-07-21 | Not applicable | No public exploit | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16359 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16358 | Critical | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16357 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16356 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16355 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |