Search
Find a vulnerability
Search criteria
8497 vulnerabilities by mozilla
CERTFR-2026-AVI-1272
Vulnerability from certfr_avis - Published: 2026-10-07 - Updated: 2026-10-07
Une vulnérabilité a été découverte dans les produits Mozilla. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox versions ant\u00e9rieures \u00e0 157.0.1",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-106016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106016"
}
],
"initial_release_date": "2026-10-07T00:00:00",
"last_revision_date": "2026-10-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1272",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Mozilla. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-10-06",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-104",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-104/"
}
]
}
CERTFR-2026-AVI-1244
Vulnerability from certfr_avis - Published: 2026-10-01 - Updated: 2026-10-01
De multiples vulnérabilités ont été découvertes dans Mozilla Thunderbird. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Thunderbird | Thunderbird versions antérieures à 157 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 140.17 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 153.4 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 157",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 140.17",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 153.4",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-100786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100786"
},
{
"name": "CVE-2026-100763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100763"
},
{
"name": "CVE-2026-100796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100796"
},
{
"name": "CVE-2026-100829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100829"
},
{
"name": "CVE-2026-100824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100824"
},
{
"name": "CVE-2026-100760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100760"
},
{
"name": "CVE-2026-100761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100761"
},
{
"name": "CVE-2026-100780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100780"
},
{
"name": "CVE-2026-100821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100821"
},
{
"name": "CVE-2026-100828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100828"
},
{
"name": "CVE-2026-100797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100797"
},
{
"name": "CVE-2026-100830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100830"
},
{
"name": "CVE-2026-100814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100814"
},
{
"name": "CVE-2026-100788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100788"
},
{
"name": "CVE-2026-100779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100779"
},
{
"name": "CVE-2026-100792",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100792"
},
{
"name": "CVE-2026-100784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100784"
},
{
"name": "CVE-2026-100791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100791"
},
{
"name": "CVE-2026-100812",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100812"
},
{
"name": "CVE-2026-100778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100778"
},
{
"name": "CVE-2026-100768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100768"
},
{
"name": "CVE-2026-100819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100819"
},
{
"name": "CVE-2026-100803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100803"
},
{
"name": "CVE-2026-100818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100818"
},
{
"name": "CVE-2026-100764",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100764"
},
{
"name": "CVE-2026-100816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100816"
},
{
"name": "CVE-2026-100794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100794"
},
{
"name": "CVE-2026-100799",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100799"
},
{
"name": "CVE-2026-100787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100787"
},
{
"name": "CVE-2026-100758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100758"
},
{
"name": "CVE-2026-100756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100756"
},
{
"name": "CVE-2026-100806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100806"
},
{
"name": "CVE-2026-100771",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100771"
},
{
"name": "CVE-2026-100762",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100762"
},
{
"name": "CVE-2026-103500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103500"
},
{
"name": "CVE-2026-100801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100801"
},
{
"name": "CVE-2026-100782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100782"
},
{
"name": "CVE-2026-100757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100757"
},
{
"name": "CVE-2026-100793",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100793"
},
{
"name": "CVE-2026-100815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100815"
},
{
"name": "CVE-2026-100822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100822"
},
{
"name": "CVE-2026-100770",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100770"
},
{
"name": "CVE-2026-100805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100805"
},
{
"name": "CVE-2026-100804",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100804"
},
{
"name": "CVE-2026-100817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100817"
},
{
"name": "CVE-2026-100774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100774"
},
{
"name": "CVE-2026-100781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100781"
},
{
"name": "CVE-2026-96869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96869"
},
{
"name": "CVE-2026-92035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92035"
},
{
"name": "CVE-2026-100820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100820"
},
{
"name": "CVE-2026-100772",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100772"
},
{
"name": "CVE-2026-100813",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100813"
},
{
"name": "CVE-2026-100775",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100775"
},
{
"name": "CVE-2026-100789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100789"
},
{
"name": "CVE-2026-100826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100826"
},
{
"name": "CVE-2026-100783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100783"
},
{
"name": "CVE-2026-100798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100798"
},
{
"name": "CVE-2026-100773",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100773"
},
{
"name": "CVE-2026-100809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100809"
},
{
"name": "CVE-2026-100807",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100807"
},
{
"name": "CVE-2026-100776",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100776"
},
{
"name": "CVE-2026-100832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100832"
},
{
"name": "CVE-2026-100800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100800"
},
{
"name": "CVE-2026-100810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100810"
},
{
"name": "CVE-2026-100825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100825"
},
{
"name": "CVE-2026-100766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100766"
},
{
"name": "CVE-2026-100802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100802"
},
{
"name": "CVE-2026-100831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100831"
},
{
"name": "CVE-2026-100759",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100759"
},
{
"name": "CVE-2026-100777",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100777"
},
{
"name": "CVE-2026-100790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100790"
},
{
"name": "CVE-2026-100767",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100767"
},
{
"name": "CVE-2026-100808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100808"
},
{
"name": "CVE-2026-100785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100785"
},
{
"name": "CVE-2026-100795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100795"
},
{
"name": "CVE-2026-100811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100811"
},
{
"name": "CVE-2026-100765",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100765"
},
{
"name": "CVE-2026-100769",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100769"
}
],
"initial_release_date": "2026-10-01T00:00:00",
"last_revision_date": "2026-10-01T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1244",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-01T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mozilla Thunderbird. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Thunderbird",
"vendor_advisories": [
{
"published_at": "2026-09-30",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-101",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-101/"
},
{
"published_at": "2026-09-30",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-103",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/"
},
{
"published_at": "2026-09-30",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-102",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-102/"
}
]
}
CERTFR-2026-AVI-1240
Vulnerability from certfr_avis - Published: 2026-09-30 - Updated: 2026-09-30
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 140.17 | ||
| Mozilla | Firefox | Firefox versions antérieures à 157 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.42 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 153.4 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 140.17",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox versions ant\u00e9rieures \u00e0 157",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.42",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 153.4",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-100786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100786"
},
{
"name": "CVE-2026-100763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100763"
},
{
"name": "CVE-2026-100796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100796"
},
{
"name": "CVE-2026-100829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100829"
},
{
"name": "CVE-2026-100824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100824"
},
{
"name": "CVE-2026-100760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100760"
},
{
"name": "CVE-2026-100761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100761"
},
{
"name": "CVE-2026-100780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100780"
},
{
"name": "CVE-2026-100821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100821"
},
{
"name": "CVE-2026-100828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100828"
},
{
"name": "CVE-2026-100797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100797"
},
{
"name": "CVE-2026-100830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100830"
},
{
"name": "CVE-2026-100814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100814"
},
{
"name": "CVE-2026-100788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100788"
},
{
"name": "CVE-2026-100779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100779"
},
{
"name": "CVE-2026-100792",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100792"
},
{
"name": "CVE-2026-100784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100784"
},
{
"name": "CVE-2026-100791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100791"
},
{
"name": "CVE-2026-100812",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100812"
},
{
"name": "CVE-2026-100778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100778"
},
{
"name": "CVE-2026-100768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100768"
},
{
"name": "CVE-2026-100819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100819"
},
{
"name": "CVE-2026-100803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100803"
},
{
"name": "CVE-2026-100818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100818"
},
{
"name": "CVE-2026-100764",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100764"
},
{
"name": "CVE-2026-100816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100816"
},
{
"name": "CVE-2026-100794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100794"
},
{
"name": "CVE-2026-100799",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100799"
},
{
"name": "CVE-2026-100787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100787"
},
{
"name": "CVE-2026-100758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100758"
},
{
"name": "CVE-2026-100756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100756"
},
{
"name": "CVE-2026-100806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100806"
},
{
"name": "CVE-2026-100771",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100771"
},
{
"name": "CVE-2026-100762",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100762"
},
{
"name": "CVE-2026-100801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100801"
},
{
"name": "CVE-2026-100782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100782"
},
{
"name": "CVE-2026-100757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100757"
},
{
"name": "CVE-2026-100793",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100793"
},
{
"name": "CVE-2026-100815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100815"
},
{
"name": "CVE-2026-100822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100822"
},
{
"name": "CVE-2026-100770",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100770"
},
{
"name": "CVE-2026-100805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100805"
},
{
"name": "CVE-2026-100804",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100804"
},
{
"name": "CVE-2026-100817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100817"
},
{
"name": "CVE-2026-100774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100774"
},
{
"name": "CVE-2026-100781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100781"
},
{
"name": "CVE-2026-96869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96869"
},
{
"name": "CVE-2026-92035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92035"
},
{
"name": "CVE-2026-100820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100820"
},
{
"name": "CVE-2026-100772",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100772"
},
{
"name": "CVE-2026-100813",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100813"
},
{
"name": "CVE-2026-100775",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100775"
},
{
"name": "CVE-2026-100789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100789"
},
{
"name": "CVE-2026-100826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100826"
},
{
"name": "CVE-2026-100783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100783"
},
{
"name": "CVE-2026-100798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100798"
},
{
"name": "CVE-2026-100773",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100773"
},
{
"name": "CVE-2026-100809",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100809"
},
{
"name": "CVE-2026-100807",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100807"
},
{
"name": "CVE-2026-100776",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100776"
},
{
"name": "CVE-2026-100832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100832"
},
{
"name": "CVE-2026-100800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100800"
},
{
"name": "CVE-2026-100810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100810"
},
{
"name": "CVE-2026-100825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100825"
},
{
"name": "CVE-2026-100766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100766"
},
{
"name": "CVE-2026-100802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100802"
},
{
"name": "CVE-2026-100831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100831"
},
{
"name": "CVE-2026-100759",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100759"
},
{
"name": "CVE-2026-100823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100823"
},
{
"name": "CVE-2026-100777",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100777"
},
{
"name": "CVE-2026-100790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100790"
},
{
"name": "CVE-2026-100767",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100767"
},
{
"name": "CVE-2026-100808",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100808"
},
{
"name": "CVE-2026-100785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100785"
},
{
"name": "CVE-2026-100795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100795"
},
{
"name": "CVE-2026-100811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100811"
},
{
"name": "CVE-2026-100765",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100765"
},
{
"name": "CVE-2026-100769",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100769"
}
],
"initial_release_date": "2026-09-30T00:00:00",
"last_revision_date": "2026-09-30T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1240",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-30T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-09-29",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-100",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/"
},
{
"published_at": "2026-09-29",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-98",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-98/"
},
{
"published_at": "2026-09-29",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-97",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/"
},
{
"published_at": "2026-09-29",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-99",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-99/"
}
]
}
CVE-2026-106550 (GCVE-0-2026-106550)
Vulnerability from nvd – Published: 2026-10-06 20:09 – Updated: 2026-10-07 19:33
VLAI
EPSS
VEX
Title
CVE-2026-106550
Summary
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:05 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-400 - Uncontrolled Resource Consumption (‘Denial of Service’)
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Node-convict |
Affected:
6.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:05:14.037126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:05:19.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Node-convict",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "6.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mozilla\u0027s Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype\u2011pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.\u003ckey\u003e, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u2018Prototype Pollution\u2019)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption (\u2018Denial of Service\u2019)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:33:03.505Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/mozilla/node-convict"
},
{
"url": "https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-106550",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-106550"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-106550",
"datePublished": "2026-10-06T20:09:55.919Z",
"dateReserved": "2026-10-06T20:07:46.075Z",
"dateUpdated": "2026-10-07T19:33:03.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106016 (GCVE-0-2026-106016)
Vulnerability from nvd – Published: 2026-10-06 12:30 – Updated: 2026-10-07 22:06
VLAI
EPSS
VEX
Title
Mitigation bypass in the File Handling component
Summary
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 21:00 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106016",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T21:00:58.433280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:06:36.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Abdulrahman Alzahrani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1."
}
],
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T12:30:49.897Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067465"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-104/"
}
],
"title": "Mitigation bypass in the File Handling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-106016",
"datePublished": "2026-10-06T12:30:49.897Z",
"dateReserved": "2026-10-06T12:30:49.691Z",
"dateUpdated": "2026-10-07T22:06:36.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103500 (GCVE-0-2026-103500)
Vulnerability from nvd – Published: 2026-09-30 17:15 – Updated: 2026-09-30 17:19
VLAI
EPSS
VEX
Title
Heap buffer overflow opening large email
Summary
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Albalawi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4."
}
],
"value": "An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:19:56.134Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2070267"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
}
],
"title": "Heap buffer overflow opening large email"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-103500",
"datePublished": "2026-09-30T17:15:06.357Z",
"dateReserved": "2026-09-30T17:15:06.146Z",
"dateUpdated": "2026-09-30T17:19:56.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96869 (GCVE-0-2026-96869)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
Information disclosure in the Networking component
Summary
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 14:35 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Firefox |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-96869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T14:35:35.881077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T14:35:59.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Carlo Di Dato"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
}
],
"value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:38.391Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2041248"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
}
],
"title": "Information disclosure in the Networking component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-96869",
"datePublished": "2026-09-29T12:36:15.110Z",
"dateReserved": "2026-09-23T18:05:43.142Z",
"dateUpdated": "2026-09-30T17:20:38.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100832 (GCVE-0-2026-100832)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
Use-after-free in the Graphics: Canvas2D component
Summary
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 13:09 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.42 , ≤ 115.*
(rpm)
Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100832",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T13:09:07.999512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T13:09:12.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.42",
"versionType": "rpm"
},
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17."
}
],
"value": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:34.544Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072467"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
}
],
"title": "Use-after-free in the Graphics: Canvas2D component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100832",
"datePublished": "2026-09-29T12:36:35.869Z",
"dateReserved": "2026-09-26T19:19:05.827Z",
"dateUpdated": "2026-09-30T17:20:34.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100831 (GCVE-0-2026-100831)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:21
VLAI
EPSS
VEX
Title
Use-after-free in the DOM: UI Events & Focus Handling component
Summary
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 13:12 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100831",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T13:12:18.595259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T13:12:47.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: UI Events \u0026 Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Use-after-free in the DOM: UI Events \u0026 Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:15.823Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067172"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Use-after-free in the DOM: UI Events \u0026 Focus Handling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100831",
"datePublished": "2026-09-29T12:36:35.297Z",
"dateReserved": "2026-09-26T19:19:03.382Z",
"dateUpdated": "2026-09-30T17:21:15.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100830 (GCVE-0-2026-100830)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 15:46
VLAI
EPSS
VEX
Title
Mitigation bypass in the DOM: Navigation component
Summary
Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:45 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:45:03.608761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:46:25.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Finn Westendorf"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:14.572Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2066770"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Mitigation bypass in the DOM: Navigation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100830",
"datePublished": "2026-09-29T12:36:34.726Z",
"dateReserved": "2026-09-26T19:19:00.904Z",
"dateUpdated": "2026-10-01T15:46:25.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100829 (GCVE-0-2026-100829)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 15:25
VLAI
EPSS
VEX
Title
Mitigation bypass in the DOM: Security component
Summary
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:25 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:25:22.394461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:25:27.320Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rintaro Kawasugi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:13.305Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2066321"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Mitigation bypass in the DOM: Security component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100829",
"datePublished": "2026-09-29T12:36:34.192Z",
"dateReserved": "2026-09-26T19:18:58.255Z",
"dateUpdated": "2026-10-01T15:25:27.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100828 (GCVE-0-2026-100828)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 15:26
VLAI
EPSS
VEX
Title
Mitigation bypass in the Bookmarks & History component
Summary
Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:26 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:26:03.862588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:26:07.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rintaro Kawasugi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the Bookmarks \u0026 History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Mitigation bypass in the Bookmarks \u0026 History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:12.048Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2066019"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Mitigation bypass in the Bookmarks \u0026 History component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100828",
"datePublished": "2026-09-29T12:36:33.675Z",
"dateReserved": "2026-09-26T19:18:55.211Z",
"dateUpdated": "2026-10-01T15:26:07.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100826 (GCVE-0-2026-100826)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:21
VLAI
EPSS
VEX
Title
Denial-of-service in the Storage: StorageManager component
Summary
Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 13:37 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100826",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T13:37:29.871620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T13:37:33.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:10.780Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059222"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Denial-of-service in the Storage: StorageManager component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100826",
"datePublished": "2026-09-29T12:36:33.140Z",
"dateReserved": "2026-09-26T19:18:50.051Z",
"dateUpdated": "2026-09-30T17:21:10.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100825 (GCVE-0-2026-100825)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:21
VLAI
EPSS
VEX
Title
Use-after-free in the JavaScript Engine: JIT component
Summary
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 13:12 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T13:12:31.018232Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T13:12:36.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "x0e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:09.522Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2057465"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Use-after-free in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100825",
"datePublished": "2026-09-29T12:36:32.575Z",
"dateReserved": "2026-09-26T19:18:45.901Z",
"dateUpdated": "2026-09-30T17:21:09.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100824 (GCVE-0-2026-100824)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:21
VLAI
EPSS
VEX
Title
Privilege escalation in the Places component
Summary
Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 00:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100824",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T03:56:09.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:08.263Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2054767"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Privilege escalation in the Places component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100824",
"datePublished": "2026-09-29T12:36:32.041Z",
"dateReserved": "2026-09-26T19:18:43.647Z",
"dateUpdated": "2026-09-30T17:21:08.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100823 (GCVE-0-2026-100823)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 10:50
VLAI
EPSS
VEX
Title
Spoofing issue in the Downloads component in Firefox for Android
Summary
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 19:46 UTC
CWE
- CWE-451 - User Interface (UI) Misrepresentation of Critical Information
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:46:51.030163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T10:50:23.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Abdul Samad"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157."
}
],
"value": "Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T12:36:31.480Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2054384"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Spoofing issue in the Downloads component in Firefox for Android"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100823",
"datePublished": "2026-09-29T12:36:31.480Z",
"dateReserved": "2026-09-26T19:18:40.744Z",
"dateUpdated": "2026-10-01T10:50:23.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100822 (GCVE-0-2026-100822)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 20:11
VLAI
EPSS
VEX
Title
Spoofing issue in the Networking: HTTP component
Summary
Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 19:46 UTC
CWE
- CWE-451 - User Interface (UI) Misrepresentation of Critical Information
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:46:40.005806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:11:10.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tomoya Nakanishi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:06.977Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2051115"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Spoofing issue in the Networking: HTTP component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100822",
"datePublished": "2026-09-29T12:36:30.870Z",
"dateReserved": "2026-09-26T19:18:38.463Z",
"dateUpdated": "2026-09-30T20:11:10.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100821 (GCVE-0-2026-100821)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 15:55
VLAI
EPSS
VEX
Title
Site isolation issue in the Panning and Zooming component
Summary
Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:55 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.42 , ≤ 115.*
(rpm)
Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:55:12.732044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:55:15.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.42",
"versionType": "rpm"
},
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Thanh Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
}
],
"value": "Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:50.356Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071784"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
}
],
"title": "Site isolation issue in the Panning and Zooming component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100821",
"datePublished": "2026-09-29T12:36:30.318Z",
"dateReserved": "2026-09-26T19:18:35.743Z",
"dateUpdated": "2026-10-01T15:55:15.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100820 (GCVE-0-2026-100820)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
Privilege escalation in the Address Bar component
Summary
Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 00:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Firefox |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100820",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T03:56:10.175Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tran Quac"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
}
],
"value": "Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:49.107Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071645"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
}
],
"title": "Privilege escalation in the Address Bar component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100820",
"datePublished": "2026-09-29T12:36:29.773Z",
"dateReserved": "2026-09-26T19:18:33.069Z",
"dateUpdated": "2026-09-30T17:20:49.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100819 (GCVE-0-2026-100819)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
Sandbox escape due to incorrect boundary conditions in the XPCOM component
Summary
Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 00:00 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.42 , ≤ 115.*
(rpm)
Unaffected: 140.17 , ≤ 140.* (rpm) Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T03:56:11.090Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.42",
"versionType": "rpm"
},
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
}
],
"value": "Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:47.763Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071069"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-98/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
}
],
"title": "Sandbox escape due to incorrect boundary conditions in the XPCOM component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100819",
"datePublished": "2026-09-29T12:36:29.199Z",
"dateReserved": "2026-09-26T19:18:30.736Z",
"dateUpdated": "2026-09-30T17:20:47.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100818 (GCVE-0-2026-100818)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
Sandbox escape due to use-after-free in the Widget: Gtk component
Summary
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 13:13 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Firefox |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T13:13:15.417892Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T13:13:29.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
}
],
"value": "Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:46.498Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2069399"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-99/"
}
],
"title": "Sandbox escape due to use-after-free in the Widget: Gtk component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100818",
"datePublished": "2026-09-29T12:36:28.602Z",
"dateReserved": "2026-09-26T19:18:28.415Z",
"dateUpdated": "2026-09-30T17:20:46.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100817 (GCVE-0-2026-100817)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 15:51
VLAI
EPSS
VEX
Title
Other issue in the JavaScript: WebAssembly component
Summary
Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:36 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
157 , ≤ *
(rpm)
|
|
| Mozilla | Firefox |
Unaffected:
157 , ≤ *
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100817",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:36:50.438550Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:51:12.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157."
}
],
"value": "Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:15:02.023Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068670"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Other issue in the JavaScript: WebAssembly component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100817",
"datePublished": "2026-09-29T12:36:28.052Z",
"dateReserved": "2026-09-26T19:18:26.116Z",
"dateUpdated": "2026-10-01T15:51:12.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100816 (GCVE-0-2026-100816)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-10-01 15:38
VLAI
EPSS
VEX
Title
Site isolation issue in the DOM: Networking component
Summary
Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:38 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100816",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:38:39.482643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:38:57.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rintaro Kawasugi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:05.685Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068648"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Site isolation issue in the DOM: Networking component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100816",
"datePublished": "2026-09-29T12:36:27.446Z",
"dateReserved": "2026-09-26T19:18:23.881Z",
"dateUpdated": "2026-10-01T15:38:57.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100815 (GCVE-0-2026-100815)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:21
VLAI
EPSS
VEX
Title
Use-after-free in the CSS Parsing and Computation component
Summary
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100815",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T03:56:12.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:04.414Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068404"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Use-after-free in the CSS Parsing and Computation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100815",
"datePublished": "2026-09-29T12:36:26.926Z",
"dateReserved": "2026-09-26T19:18:21.430Z",
"dateUpdated": "2026-09-30T17:21:04.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-100814 (GCVE-0-2026-100814)
Vulnerability from nvd – Published: 2026-09-29 12:36 – Updated: 2026-09-30 17:21
VLAI
EPSS
VEX
Title
Incorrect boundary conditions in the JavaScript Engine: JIT component
Summary
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 14:25 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
153.4 , ≤ 153.*
(rpm)
Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-100814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T14:25:01.607085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T14:25:07.830Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"value": "Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:21:03.168Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068385"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-100/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-97/"
}
],
"title": "Incorrect boundary conditions in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-100814",
"datePublished": "2026-09-29T12:36:26.377Z",
"dateReserved": "2026-09-26T19:18:18.950Z",
"dateUpdated": "2026-09-30T17:21:03.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106550 (GCVE-0-2026-106550)
Vulnerability from cvelistv5 – Published: 2026-10-06 20:09 – Updated: 2026-10-07 19:33
VLAI
EPSS
VEX
Title
CVE-2026-106550
Summary
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:05 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-400 - Uncontrolled Resource Consumption (‘Denial of Service’)
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Node-convict |
Affected:
6.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:05:14.037126Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:05:19.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Node-convict",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "6.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mozilla\u0027s Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype\u2011pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.\u003ckey\u003e, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set()."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u2018Prototype Pollution\u2019)",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption (\u2018Denial of Service\u2019)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:33:03.505Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://github.com/mozilla/node-convict"
},
{
"url": "https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-106550",
"x_generator": {
"engine": "VINCE 3.0.50",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-106550"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-106550",
"datePublished": "2026-10-06T20:09:55.919Z",
"dateReserved": "2026-10-06T20:07:46.075Z",
"dateUpdated": "2026-10-07T19:33:03.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106016 (GCVE-0-2026-106016)
Vulnerability from cvelistv5 – Published: 2026-10-06 12:30 – Updated: 2026-10-07 22:06
VLAI
EPSS
VEX
Title
Mitigation bypass in the File Handling component
Summary
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 21:00 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106016",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T21:00:58.433280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T22:06:36.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Abdulrahman Alzahrani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1."
}
],
"value": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T12:30:49.897Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2067465"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-104/"
}
],
"title": "Mitigation bypass in the File Handling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-106016",
"datePublished": "2026-10-06T12:30:49.897Z",
"dateReserved": "2026-10-06T12:30:49.691Z",
"dateUpdated": "2026-10-07T22:06:36.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103500 (GCVE-0-2026-103500)
Vulnerability from cvelistv5 – Published: 2026-09-30 17:15 – Updated: 2026-09-30 17:19
VLAI
EPSS
VEX
Title
Heap buffer overflow opening large email
Summary
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
140.17 , ≤ 140.*
(rpm)
Unaffected: 153.4 , ≤ 153.* (rpm) Unaffected: 157 , ≤ * (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "140.*",
"status": "unaffected",
"version": "140.17",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.4",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "157",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Albalawi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4."
}
],
"value": "An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:19:56.134Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2070267"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-101/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-102/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-103/"
}
],
"title": "Heap buffer overflow opening large email"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-103500",
"datePublished": "2026-09-30T17:15:06.357Z",
"dateReserved": "2026-09-30T17:15:06.146Z",
"dateUpdated": "2026-09-30T17:19:56.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0385
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
[Bugtraq] [slackware-security] mozilla-thunderbird (SSA:2026-247-03)
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] mozilla-thunderbird (SSA:2026-247-03)
New mozilla-thunderbird packages are available for Slackware 15.0 and -current
to fix security issues.
Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/140.15.0esr/releasenotes/
https://www.mozilla.org/en-US/security/advisories/mfsa2026-87/
https://www.cve.org/CVERecord?id=CVE-2026-84639
https://www.cve.org/CVERecord?id=CVE-2026-84640
https://www.cve.org/CVERecord?id=CVE-2026-84641
https://www.cve.org/CVERecord?id=CVE-2026-75874
https://www.cve.org/CVERecord?id=CVE-2026-16365
https://www.cve.org/CVERecord?id=CVE-2026-84119
https://www.cve.org/CVERecord?id=CVE-2026-84120
https://www.cve.org/CVERecord?id=CVE-2026-84121
https://www.cve.org/CVERecord?id=CVE-2026-84122
https://www.cve.org/CVERecord?id=CVE-2026-84124
https://www.cve.org/CVERecord?id=CVE-2026-16371
https://www.cve.org/CVERecord?id=CVE-2026-84131
https://www.cve.org/CVERecord?id=CVE-2026-84143
https://www.cve.org/CVERecord?id=CVE-2026-84145
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz
Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/mozilla-thunderbird-140.15.0esr-x86_64-1_slack15.0.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-thunderbird-153.2.0esr-i686-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-thunderbird-153.2.0esr-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 15.0 package:
9ac4c03b12a2c2a30b53eb280e3f5b60 mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz
Slackware x86_64 15.0 package:
a811488a4dabcefe4c38be0c91628cef mozilla-thunderbird-140.15.0esr-x86_64-1_slack15.0.txz
Slackware -current package:
6971cf1422471452bdd6cb9845460d58 xap/mozilla-thunderbird-153.2.0esr-i686-1.txz
Slackware x86_64 -current package:
3613978263e8097b2ee262fccfc4d4c3 xap/mozilla-thunderbird-153.2.0esr-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
iHkEARECADkWIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCapuLFRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIACgkQakRjwEAQIjPE9gCeJj1yTj6bdtxltBbm0CCK
6+Q6xR0AnjRYrDmu8E4j8PqvnJsva+l9ZTKQ
=7vuj
-----END PGP SIGNATURE-----
Severity
No CVSS data available.
Assigner
References
21 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | SSA:2026-247-03 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0385 (this record)
- related CVE-2026-16365
- related CVE-2026-16371
- related CVE-2026-75874
- related CVE-2026-84119
- related CVE-2026-84120
- related CVE-2026-84121
- related CVE-2026-84122
- related CVE-2026-84124
- related CVE-2026-84131
- related CVE-2026-84143
- related CVE-2026-84145
- related CVE-2026-84639
- related CVE-2026-84640
- related CVE-2026-84641
{
"containers": {
"cna": {
"affected": [
{
"product": "SSA:2026-247-03",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Slackware Security Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n[slackware-security] mozilla-thunderbird (SSA:2026-247-03)\nNew mozilla-thunderbird packages are available for Slackware 15.0 and -current\nto fix security issues.\nHere are the details from the Slackware 15.0 ChangeLog:\n+--------------------------+\npatches/packages/mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz: Upgraded.\nThis release contains security fixes and improvements.\nFor more information, see:\nhttps://www.mozilla.org/en-US/thunderbird/140.15.0esr/releasenotes/\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2026-87/\nhttps://www.cve.org/CVERecord?id=CVE-2026-84639\nhttps://www.cve.org/CVERecord?id=CVE-2026-84640\nhttps://www.cve.org/CVERecord?id=CVE-2026-84641\nhttps://www.cve.org/CVERecord?id=CVE-2026-75874\nhttps://www.cve.org/CVERecord?id=CVE-2026-16365\nhttps://www.cve.org/CVERecord?id=CVE-2026-84119\nhttps://www.cve.org/CVERecord?id=CVE-2026-84120\nhttps://www.cve.org/CVERecord?id=CVE-2026-84121\nhttps://www.cve.org/CVERecord?id=CVE-2026-84122\nhttps://www.cve.org/CVERecord?id=CVE-2026-84124\nhttps://www.cve.org/CVERecord?id=CVE-2026-16371\nhttps://www.cve.org/CVERecord?id=CVE-2026-84131\nhttps://www.cve.org/CVERecord?id=CVE-2026-84143\nhttps://www.cve.org/CVERecord?id=CVE-2026-84145\n(* Security fix *)\n+--------------------------+\nWhere to find the new packages:\n+-----------------------------+\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\nUpdated package for Slackware 15.0:\nftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz\nUpdated package for Slackware x86_64 15.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/mozilla-thunderbird-140.15.0esr-x86_64-1_slack15.0.txz\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-thunderbird-153.2.0esr-i686-1.txz\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-thunderbird-153.2.0esr-x86_64-1.txz\nMD5 signatures:\n+-------------+\nSlackware 15.0 package:\n9ac4c03b12a2c2a30b53eb280e3f5b60 mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz\nSlackware x86_64 15.0 package:\na811488a4dabcefe4c38be0c91628cef mozilla-thunderbird-140.15.0esr-x86_64-1_slack15.0.txz\nSlackware -current package:\n6971cf1422471452bdd6cb9845460d58 xap/mozilla-thunderbird-153.2.0esr-i686-1.txz\nSlackware x86_64 -current package:\n3613978263e8097b2ee262fccfc4d4c3 xap/mozilla-thunderbird-153.2.0esr-x86_64-1.txz\nInstallation instructions:\n+------------------------+\nUpgrade the package as root:\n# upgradepkg mozilla-thunderbird-140.15.0esr-i686-1_slack15.0.txz\n+-----+\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list: |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message: |\n| |\n| unsubscribe slackware-security |\n| |\n| You will get a confirmation message back containing instructions to |\n| complete the process. Please do not reply to this email address. |\n+------------------------------------------------------------------------+\n-----BEGIN PGP SIGNATURE-----\niHkEARECADkWIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCapuLFRsUgAAAAAAEAA5t\nYW51MiwyLjUrMS4xMiwyLDIACgkQakRjwEAQIjPE9gCeJj1yTj6bdtxltBbm0CCK\n6+Q6xR0AnjRYrDmu8E4j8PqvnJsva+l9ZTKQ\n=7vuj\n-----END PGP SIGNATURE-----"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:25Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/item/8b72bf587cba7f8dc73503651f28087d4c53a018ac82c2221cfe83a0b7cd2b9e"
},
{
"tags": [
"technical-description"
],
"url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/JYNQFMIDK5N7ZLAPOX57ZLFBTORAYTOP/"
},
{
"url": "http://osuosl.org"
},
{
"url": "http://slackware.com"
},
{
"url": "http://slackware.com/gpg-key"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16365"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16371"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75874"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84119"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84120"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84121"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84122"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84124"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84131"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84143"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84145"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84639"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84640"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84641"
},
{
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-87/"
},
{
"url": "https://www.mozilla.org/en-US/thunderbird/140.15.0esr/releasenotes/"
}
],
"source": {
"defect": [
"alpine.LNX.2.02.2609042059450.26166%40connie.slackware.com"
],
"discovery": "EXTERNAL"
},
"title": "[Bugtraq] [slackware-security] mozilla-thunderbird (SSA:2026-247-03)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-16365",
"type": "related"
},
{
"destId": "CVE-2026-16371",
"type": "related"
},
{
"destId": "CVE-2026-75874",
"type": "related"
},
{
"destId": "CVE-2026-84119",
"type": "related"
},
{
"destId": "CVE-2026-84120",
"type": "related"
},
{
"destId": "CVE-2026-84121",
"type": "related"
},
{
"destId": "CVE-2026-84122",
"type": "related"
},
{
"destId": "CVE-2026-84124",
"type": "related"
},
{
"destId": "CVE-2026-84131",
"type": "related"
},
{
"destId": "CVE-2026-84143",
"type": "related"
},
{
"destId": "CVE-2026-84145",
"type": "related"
},
{
"destId": "CVE-2026-84639",
"type": "related"
},
{
"destId": "CVE-2026-84640",
"type": "related"
},
{
"destId": "CVE-2026-84641",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0385",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/item/8b72bf587cba7f8dc73503651f28087d4c53a018ac82c2221cfe83a0b7cd2b9e",
"automated": true,
"contentSha256": "8b72bf587cba7f8dc73503651f28087d4c53a018ac82c2221cfe83a0b7cd2b9e",
"evidenceScore": 6,
"messageId": "alpine.LNX.2.02.2609042059450.26166%40connie.slackware.com",
"originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/JYNQFMIDK5N7ZLAPOX57ZLFBTORAYTOP/",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-02T04:57:25Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0385"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:25Z",
"dateUpdated": "2026-10-02T04:57:25Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0385"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0384
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
[Bugtraq] [slackware-security] mozilla-firefox (SSA:2026-247-02)
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] mozilla-firefox (SSA:2026-247-02)
New mozilla-firefox packages are available for Slackware 15.0 and -current to
fix security issues.
Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/firefox/140.15.0/releasenotes/
https://www.mozilla.org/security/advisories/mfsa2026-84/
https://www.cve.org/CVERecord?id=CVE-2026-75874
https://www.cve.org/CVERecord?id=CVE-2026-16365
https://www.cve.org/CVERecord?id=CVE-2026-84119
https://www.cve.org/CVERecord?id=CVE-2026-84120
https://www.cve.org/CVERecord?id=CVE-2026-84121
https://www.cve.org/CVERecord?id=CVE-2026-84122
https://www.cve.org/CVERecord?id=CVE-2026-84124
https://www.cve.org/CVERecord?id=CVE-2026-16371
https://www.cve.org/CVERecord?id=CVE-2026-84131
https://www.cve.org/CVERecord?id=CVE-2026-84143
https://www.cve.org/CVERecord?id=CVE-2026-84145
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz
Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/mozilla-firefox-140.15.0esr-x86_64-1_slack15.0.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-firefox-153.2.0esr-i686-2.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-firefox-153.2.0esr-x86_64-2.txz
MD5 signatures:
+-------------+
Slackware 15.0 package:
2c902a207d6ea6693527191c8d57518e mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz
Slackware x86_64 15.0 package:
0c26cbd683b7b2597430f894fc1f9e53 mozilla-firefox-140.15.0esr-x86_64-1_slack15.0.txz
Slackware -current package:
978d48a968b37b71351d85be43d399d9 xap/mozilla-firefox-153.2.0esr-i686-2.txz
Slackware x86_64 -current package:
4a329e27d491f0499fd34420cec11bc3 xap/mozilla-firefox-153.2.0esr-x86_64-2.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
iHgEARECADkWIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCapuLEhsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIACgkQakRjwEAQIjPy1wCfXjT0NGtXwilMiNV8HPR6
8UwFM/oAmOSOZ+lOK3Bcv3OLfJygpEvzlEg=
=BlIE
-----END PGP SIGNATURE-----
Severity
No CVSS data available.
Assigner
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | SSA:2026-247-02 |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0384 (this record)
- related CVE-2026-16365
- related CVE-2026-16371
- related CVE-2026-75874
- related CVE-2026-84119
- related CVE-2026-84120
- related CVE-2026-84121
- related CVE-2026-84122
- related CVE-2026-84124
- related CVE-2026-84131
- related CVE-2026-84143
- related CVE-2026-84145
{
"containers": {
"cna": {
"affected": [
{
"product": "SSA:2026-247-02",
"vendor": "Mozilla",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Slackware Security Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n[slackware-security] mozilla-firefox (SSA:2026-247-02)\nNew mozilla-firefox packages are available for Slackware 15.0 and -current to\nfix security issues.\nHere are the details from the Slackware 15.0 ChangeLog:\n+--------------------------+\npatches/packages/mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz: Upgraded.\nThis update contains security fixes and improvements.\nFor more information, see:\nhttps://www.mozilla.org/en-US/firefox/140.15.0/releasenotes/\nhttps://www.mozilla.org/security/advisories/mfsa2026-84/\nhttps://www.cve.org/CVERecord?id=CVE-2026-75874\nhttps://www.cve.org/CVERecord?id=CVE-2026-16365\nhttps://www.cve.org/CVERecord?id=CVE-2026-84119\nhttps://www.cve.org/CVERecord?id=CVE-2026-84120\nhttps://www.cve.org/CVERecord?id=CVE-2026-84121\nhttps://www.cve.org/CVERecord?id=CVE-2026-84122\nhttps://www.cve.org/CVERecord?id=CVE-2026-84124\nhttps://www.cve.org/CVERecord?id=CVE-2026-16371\nhttps://www.cve.org/CVERecord?id=CVE-2026-84131\nhttps://www.cve.org/CVERecord?id=CVE-2026-84143\nhttps://www.cve.org/CVERecord?id=CVE-2026-84145\n(* Security fix *)\n+--------------------------+\nWhere to find the new packages:\n+-----------------------------+\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\nUpdated package for Slackware 15.0:\nftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz\nUpdated package for Slackware x86_64 15.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/mozilla-firefox-140.15.0esr-x86_64-1_slack15.0.txz\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-firefox-153.2.0esr-i686-2.txz\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-firefox-153.2.0esr-x86_64-2.txz\nMD5 signatures:\n+-------------+\nSlackware 15.0 package:\n2c902a207d6ea6693527191c8d57518e mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz\nSlackware x86_64 15.0 package:\n0c26cbd683b7b2597430f894fc1f9e53 mozilla-firefox-140.15.0esr-x86_64-1_slack15.0.txz\nSlackware -current package:\n978d48a968b37b71351d85be43d399d9 xap/mozilla-firefox-153.2.0esr-i686-2.txz\nSlackware x86_64 -current package:\n4a329e27d491f0499fd34420cec11bc3 xap/mozilla-firefox-153.2.0esr-x86_64-2.txz\nInstallation instructions:\n+------------------------+\nUpgrade the package as root:\n# upgradepkg mozilla-firefox-140.15.0esr-i686-1_slack15.0.txz\n+-----+\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list: |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message: |\n| |\n| unsubscribe slackware-security |\n| |\n| You will get a confirmation message back containing instructions to |\n| complete the process. Please do not reply to this email address. |\n+------------------------------------------------------------------------+\n-----BEGIN PGP SIGNATURE-----\niHgEARECADkWIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCapuLEhsUgAAAAAAEAA5t\nYW51MiwyLjUrMS4xMiwyLDIACgkQakRjwEAQIjPy1wCfXjT0NGtXwilMiNV8HPR6\n8UwFM/oAmOSOZ+lOK3Bcv3OLfJygpEvzlEg=\n=BlIE\n-----END PGP SIGNATURE-----"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/item/d26794325f8b7f5e9f9f18c15db430b4b329d68f65af7a9238991c2c787104a2"
},
{
"tags": [
"technical-description"
],
"url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/MMP4S7AXVNWBWM2WDMD3JTCQ33AMAJVN/"
},
{
"url": "http://osuosl.org"
},
{
"url": "http://slackware.com"
},
{
"url": "http://slackware.com/gpg-key"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16365"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16371"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75874"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84119"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84120"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84121"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84122"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84124"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84131"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84143"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84145"
},
{
"url": "https://www.mozilla.org/en-US/firefox/140.15.0/releasenotes/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-84/"
}
],
"source": {
"defect": [
"alpine.LNX.2.02.2609042059210.26166%40connie.slackware.com"
],
"discovery": "EXTERNAL"
},
"title": "[Bugtraq] [slackware-security] mozilla-firefox (SSA:2026-247-02)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-16365",
"type": "related"
},
{
"destId": "CVE-2026-16371",
"type": "related"
},
{
"destId": "CVE-2026-75874",
"type": "related"
},
{
"destId": "CVE-2026-84119",
"type": "related"
},
{
"destId": "CVE-2026-84120",
"type": "related"
},
{
"destId": "CVE-2026-84121",
"type": "related"
},
{
"destId": "CVE-2026-84122",
"type": "related"
},
{
"destId": "CVE-2026-84124",
"type": "related"
},
{
"destId": "CVE-2026-84131",
"type": "related"
},
{
"destId": "CVE-2026-84143",
"type": "related"
},
{
"destId": "CVE-2026-84145",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0384",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/item/d26794325f8b7f5e9f9f18c15db430b4b329d68f65af7a9238991c2c787104a2",
"automated": true,
"contentSha256": "d26794325f8b7f5e9f9f18c15db430b4b329d68f65af7a9238991c2c787104a2",
"evidenceScore": 6,
"messageId": "alpine.LNX.2.02.2609042059210.26166%40connie.slackware.com",
"originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/MMP4S7AXVNWBWM2WDMD3JTCQ33AMAJVN/",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-02T04:57:24Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0384"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:24Z",
"dateUpdated": "2026-10-02T04:57:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0384"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}