Skip to content
OpenAdvisories

Vendor

Mozilla

2,456 known vulnerabilities.

Products

Firefox 2,218 Thunderbird 1,711 Firefox ESR 712 Firefox for iOS 63 Firefox for Android 33 Focus for Android 17 Thunderbird ESR 13 Focus for iOS 13 NSS 6 Focus 3 WebThings Gateway 2 Mozilla Bleach 2 Hubs Cloud 2 Mozilla VPN 2 Node-convict 1 Network Security Services (NSS) 1 thin-vec 1 Mozilla VPN 2.28.0 1 hawk 1 rhino 1 Firefox for 1 geckodriver 1 common-voice 1 Convict 1 Bugzilla 1 Persona 1 Network Security Services 1 Nunjucks 1 Klar for iOS 1 neqo 1 Mozilla VPN iOS 1.0.7 1 Mozilla VPN Windows 1 Mozilla VPN Android 1.1.0 1 sccache 1 Mozilla VPN 2.16.1 1 PollBot 1 Thunderbird < 102.8 0 Thunderbird < 102.9 0 Thunderbird < 102.9.1 0 Firefox < 110.1.0 Android 0
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-109721 Public exploit

    Incorrect boundary conditions in the JavaScript Engine: JIT component

    Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2026-84118 Public exploit

    Use-after-free in the JavaScript: GC component

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Medium 5.4
    CVE-2026-74970 Public exploit

    Site isolation issue in the Graphics component

    Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Medium 6.5
    CVE-2026-74945 Public exploit

    Information disclosure in the Graphics: Text component

    Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-15718 Public exploit

    Invalid pointer in the JavaScript: WebAssembly component

    We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-10702 Public exploit

    JIT miscompilation in the JavaScript Engine: JIT component

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu
  • Medium 6.5
    CVE-2026-8388 Public exploit

    Incorrect boundary conditions in the JavaScript Engine: JIT component

    Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-6770 Public exploit

    Other issue in the Storage: IndexedDB component

    Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.3
    CVE-2026-6765 Public exploit

    Information disclosure in the Form Autofill component

    Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2025-1015 Public exploit

    Unsanitized address book fields

    The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If anoth…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 5.6
    CVE-2024-4367 Public exploit EPSS 71%

    PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

    A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm
  • Medium 6.5
    CVE-2024-0741 Public exploit

    An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine