1962 matches found
CVE-2026-74989
Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
CVE-2026-74964
An integer overflow in Firefox/Thunderbird's Graphics component (CVSS 9.8 critical, network-exploitable with no privileges) enables arbitrary code execution, information disclosure, and denial of service. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154/140.14/153.1; Debian stable ...
CVE-2026-74940
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74963
Firefox and Thunderbird suffer a same-origin policy bypass in their Networking: Cookies component, allowing cross-origin access to cookies. CVSS 5.4 (Medium). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, 153.1. No in-the-wild exploitation reported; user interaction requir...
CVE-2026-74976
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74936
A use-after-free in the JavaScript: WebAssembly component of Firefox/Thunderbird can lead to memory corruption and arbitrary code execution. CVSS 9.8 (network, no auth required). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, and 153.1; Debian and Slackware packages updated...
CVE-2026-74968
Firefox's WebRender component has a site isolation flaw allowing cross-site data access or tampering, rated CVSS 5.4 (Medium). Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported. Users should update immediately. Mozilla advisories: mfsa2026-74, mfsa2026-77.
CVE-2026-74972
Information disclosure in Firefox/Thunderbird's DOM: Push Subscriptions component exposes sensitive data to malicious sites. CVSS 4.3 (MEDIUM), network-reachable with user interaction required. Fixed in Firefox 154, ESR 140.14/153.1, Thunderbird 154/140.14/153.1. No in-the-wild exploitation repor...
CVE-2026-74973
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74974
The vulnerability is a same-origin policy bypass in the Graphics: ImageLib component of Firefox and Thunderbird. Affected versions include Firefox ESR 140.13, ESR 153.0, and Thunderbird ESR 140.13, ESR 153.0. Remediation is to upgrade to Firefox ESR 140.14, ESR 153.1, Thunderbird 140.14, or Thund...
CVE-2026-74942
A privilege escalation flaw in Firefox's Remote Settings Client component allows a remote attacker to gain full system access with no authentication and low complexity. CVSS 8.8 (HIGH). CISA's SSVC rates technical impact as total but confirms no active exploitation. Fixed in Firefox 154, Firefox ...