Overview 2,069 matches · 0 in Waratek scope · 0 protected · 26 exploited · 14 CISA KEV · 65 public PoC · 18 EPSS ≥ 0.5
2,069matches
0in Waratek scope0.0%
0protected0.0%
26exploited1.3%
14CISA KEV0.7%
65public PoC3.1%
18EPSS ≥ 0.50.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
6
0.3%
Not applicable
2,063
99.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
2,069
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 503 / year
200413
Not applicable13
High5
Medium7
Low1
not blocked13
Working exploit published1
No public exploit12
200513
Not applicable13
High3
Medium6
Low4
not blocked13
Working exploit published1
No public exploit12
200669
Not applicable69
High32
Medium29
Low8
not blocked69
Working exploit published4
No public exploit65
200716
Not applicable16
High9
Medium6
Low1
not blocked16
Working exploit published2
Forecast only1
No public exploit13
200850
Not applicable50
High27
Medium22
Low1
not blocked50
Working exploit published1
No public exploit49
200939
Not applicable39
High23
Medium16
not blocked39
Exploited1
Working exploit published2
No public exploit36
201063
Not applicable63
Critical2
High38
Medium23
not blocked63
Exploited1
Working exploit published6
No public exploit56
201169
Not applicable69
High48
Medium19
Low2
not blocked69
Working exploit published2
No public exploit67
2012149
Not applicable149
High99
Medium48
Low2
not blocked149
Working exploit published2
No public exploit147
2013113
Outside Waratek scope1
Not applicable112
Critical6
High75
Medium32
not blocked113
Exploited4
Working exploit published3
Forecast only1
No public exploit105
201464
Outside Waratek scope2
Not applicable62
Critical9
High33
Medium21
Low1
not blocked64
Exploited2
Working exploit published2
No public exploit60
201530
Outside Waratek scope1
Not applicable29
High16
Medium13
Low1
not blocked30
Working exploit published1
Proof of concept only1
No public exploit28
201613
Not applicable13
High11
Medium2
not blocked13
Working exploit published1
No public exploit12
20171
Not applicable1
High1
not blocked1
No public exploit1
2018176
Not applicable176
Critical86
High52
Medium38
not blocked176
Exploited1
Working exploit published6
Proof of concept only1
No public exploit168
201965
Not applicable65
Critical29
High20
Medium15
Low1
not blocked65
Exploited3
Working exploit published8
Proof of concept only1
No public exploit53
202081
Not applicable81
Critical5
High43
Medium33
not blocked81
Exploited4
Working exploit published1
No public exploit76
202180
Not applicable80
Critical1
High42
Medium36
Low1
not blocked80
No public exploit80
2022116
Not applicable116
Critical13
High48
Medium55
not blocked116
Exploited7
Proof of concept only32
No public exploit77
2023102
Outside Waratek scope1
Not applicable101
Critical8
High44
Medium49
Low1
not blocked102
Exploited2
Proof of concept only22
No public exploit78
2024118
Outside Waratek scope1
Not applicable117
Critical19
High51
Medium46
Low2
not blocked118
Exploited1
Working exploit published1
Proof of concept only1
No public exploit115
2025126
Not applicable126
Critical28
High57
Medium41
not blocked126
Proof of concept only1
No public exploit125
2026503
Not applicable503
Critical182
High232
Medium89
not blocked503
Proof of concept only1
No public exploit502
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-74974 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74973 | Medium | 2026-08-18 | Not applicable | No public exploit | Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74972 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74971 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74970 | Medium | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74969 | High | 2026-08-18 | Not applicable | No public exploit | Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74968 | Medium | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74967 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74966 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74965 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74964 | Critical | 2026-08-18 | Not applicable | No public exploit | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74963 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74962 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74961 | Critical | 2026-08-18 | Not applicable | No public exploit | Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74960 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74959 | Critical | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74958 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74957 | High | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74956 | Critical | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74955 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74954 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74953 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74952 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2. |
| CVE-2026-74950 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74949 | High | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74948 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74947 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74946 | High | 2026-08-18 | Not applicable | No public exploit | Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74945 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74944 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74943 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74942 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74941 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74940 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74939 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74938 | Critical | 2026-08-18 | Not applicable | No public exploit | Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74937 | High | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74936 | Critical | 2026-08-18 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74935 | High | 2026-08-18 | Not applicable | No public exploit | Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74934 | High | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-14899 | High | 2026-07-22 | Not applicable | No public exploit | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13. |
| CVE-2026-16410 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16409 | High | 2026-07-21 | Not applicable | No public exploit | Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16407 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16403 | Medium | 2026-07-21 | Not applicable | No public exploit | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16402 | Critical | 2026-07-21 | Not applicable | No public exploit | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16401 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16400 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16399 | High | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16398 | High | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16396 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16393 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16392 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16391 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16390 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16389 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16388 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16387 | Critical | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16386 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16385 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16384 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16383 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16382 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16381 | Critical | 2026-07-21 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16380 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16379 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16378 | High | 2026-07-21 | Not applicable | No public exploit | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16377 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16376 | High | 2026-07-21 | Not applicable | No public exploit | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16375 | Critical | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16374 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16372 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16371 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15. |
| CVE-2026-16370 | Critical | 2026-07-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16369 | Critical | 2026-07-21 | Not applicable | No public exploit | Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16368 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16367 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16366 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16365 | High | 2026-07-21 | Not applicable | No public exploit | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15. |
| CVE-2026-16364 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16363 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16362 | High | 2026-07-21 | Not applicable | No public exploit | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16361 | Critical | 2026-07-21 | Not applicable | No public exploit | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. |
| CVE-2026-16360 | Critical | 2026-07-21 | Not applicable | No public exploit | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16359 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16358 | Critical | 2026-07-21 | Not applicable | No public exploit | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16357 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16356 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16355 | Critical | 2026-07-21 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16354 | High | 2026-07-21 | Not applicable | No public exploit | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16353 | Critical | 2026-07-21 | Not applicable | No public exploit | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16352 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16351 | Critical | 2026-07-21 | Not applicable | No public exploit | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16350 | Critical | 2026-07-21 | Not applicable | No public exploit | Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-16349 | Critical | 2026-07-21 | Not applicable | No public exploit | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
| CVE-2026-57963 | Medium | 2026-07-01 | Not applicable | No public exploit | An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1. |
| CVE-2026-57962 | Medium | 2026-07-01 | Not applicable | No public exploit | A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1. |
| CVE-2026-12330 | Medium | 2026-06-16 | Not applicable | No public exploit | Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12. |
| CVE-2026-12329 | High | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
| CVE-2026-12328 | High | 2026-06-16 | Not applicable | No public exploit | Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |