Mozilla - vulnerabilities (CVEs)

4204 CVEs in 60 products, 347 in the last 30 days, newest from 2026-10-27.

Products

Firefox - 3445 CVEs
Thunderbird - 2071 CVEs
Firefox Esr - 712 CVEs
Seamonkey - 704 CVEs
Thunderbird Esr - 228 CVEs
Bugzilla - 145 CVEs
Mozilla - 108 CVEs
Firefox Mobile - 87 CVEs
Firefox For Ios - 60 CVEs
Network Security Services - 50 CVEs
Firefox For Android - 33 CVEs
Mozilla Suite - 27 CVEs
Firefox Focus - 20 CVEs
Focus For Android - 17 CVEs
Focus - 16 CVEs
Firefox Os - 14 CVEs
Focus For Ios - 13 CVEs
Nss - 6 CVEs
Bleach - 5 CVEs
Bonsai - 4 CVEs
Camino - 4 CVEs
Vpn - 4 CVEs
Convict - 3 CVEs
Netscape Portable Runtime - 3 CVEs
Geckodriver - 2 CVEs
Hubs Cloud - 2 CVEs
Mozilla Bleach - 2 CVEs
Mozilla Vpn - 2 CVEs
Mozjpeg - 2 CVEs
Nunjucks - 2 CVEs
Pollbot - 2 CVEs
Webthings Gateway - 2 CVEs
0din Scanner - 1 CVEs
Common-voice - 1 CVEs
Common Voice - 1 CVEs
Durian Web Application Server - 1 CVEs
Firefox For - 1 CVEs
Firefoxos - 1 CVEs
Geckb - 1 CVEs
Gecko - 1 CVEs
Hawk - 1 CVEs
Hubs Cloud Reticulum - 1 CVEs
Klar - 1 CVEs
Klar For Ios - 1 CVEs
Libxul - 1 CVEs
Mozilla Vpn 2.16.1 - 1 CVEs
Mozilla Vpn 2.28.0 - 1 CVEs
Mozilla Vpn Android 1.1.0 - 1 CVEs
Mozilla Vpn Ios 1.0.7 - 1 CVEs
Mozilla Vpn Windows - 1 CVEs
Neqo - 1 CVEs
Network Security Services Nss - 1 CVEs
Node-convict - 1 CVEs
Nss Esr - 1 CVEs
Persona - 1 CVEs
Rhino - 1 CVEs
Sccache - 1 CVEs
Thin-vec - 1 CVEs
Zamboni - 1 CVEs
Mozilla Mail - 0 CVEs

Newest CVEs of Mozilla

CVE-2026-118180, 2026-10-27: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or…
CVE-2026-118179, 2026-10-27: Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was…
CVE-2026-118178, 2026-10-27: A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then…
CVE-2026-118177, 2026-10-27: When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations…
CVE-2026-118176, 2026-10-27: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths.…
CVE-2026-118175, 2026-10-27: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into…
CVE-2026-118174, 2026-10-27: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A…
CVE-2026-118027, 2026-10-27: Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
CVE-2026-118026, 2026-10-27: Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118025, 2026-10-27: Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118024, 2026-10-27: Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118023, 2026-10-27: Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118022, 2026-10-27: Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118021, 2026-10-27: Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118019, 2026-10-27: Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118020, 2026-10-27: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118016, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118018, 2026-10-27: Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
CVE-2026-118017, 2026-10-27: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118013, 2026-10-27: Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118015, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118014, 2026-10-27: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118010, 2026-10-27: Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118012, 2026-10-27: Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118011, 2026-10-27: Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118007, 2026-10-27: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118009, 2026-10-27: Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118008 - CVSS 8.8 (high), 2026-10-27: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118006, 2026-10-27: Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118005, 2026-10-27: Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.