Mozilla Firefox vulnerabilities
3,702 known vulnerabilities affecting mozilla/firefox.
Total CVEs
3,702
CISA KEV
15
actively exploited
Public exploits
126
Exploited in wild
34
Severity breakdown
CRITICAL981HIGH1095MEDIUM1343LOW68UNKNOWN215
Vulnerabilities
Page 155 of 186
CVE-2026-117960P4UNKNOWNfixed in Firefox 159
CVE-2026-117960 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117960
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117960
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117993P4UNKNOWNfixed in Firefox 159
CVE-2026-117993 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117993
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117993
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117969P4UNKNOWNfixed in Firefox 159
CVE-2026-117969 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117969
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117969
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117910P4UNKNOWNfixed in Firefox 159
CVE-2026-117910 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117910
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117910
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117990P4UNKNOWNfixed in Firefox 159
CVE-2026-117990 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117990
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117990
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-118002P4UNKNOWNfixed in Firefox 159
CVE-2026-118002 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118002
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118002
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117975P4UNKNOWNfixed in Firefox 159
CVE-2026-117975 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117975
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117975
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117871P4UNKNOWNfixed in Firefox 159
CVE-2026-117871 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117871
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117871
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117988P4UNKNOWNfixed in Firefox 159
CVE-2026-117988 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117988
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117988
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117956P4UNKNOWNfixed in Firefox 159
CVE-2026-117956 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117956
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117956
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117995P4UNKNOWNfixed in Firefox 159
CVE-2026-117995 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117995
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117995
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117982P4UNKNOWNfixed in Firefox 159
CVE-2026-117982 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117982
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117982
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-118011P4UNKNOWNfixed in Firefox 159
CVE-2026-118011 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118011
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118011
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-118023P4UNKNOWNfixed in Firefox 159
CVE-2026-118023 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118023
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118023
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-118024P4UNKNOWNfixed in Firefox 159
CVE-2026-118024 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118024
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118024
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2007-1256P4MEDIUMCVSS 6.8v2.0v2.0.0.1+1 more2007-03-03
CVE-2007-1256 [MEDIUM] CVE-2007-1256: Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document sou
Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.
nvd
CVE-2016-1933P4MEDIUMCVSS 6.5≤ 43.0.42016-01-31
CVE-2016-1933 [MEDIUM] CWE-189 CVE-2016-1933: Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remo
Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted GIF image.
nvdosv
CVE-2016-2839P4MEDIUMCVSS 6.5≤ 47.0.1v45.1.0+3 more2016-08-05
CVE-2016-2839 [MEDIUM] CWE-20 CVE-2016-2839: Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo _cairo_surface_get_
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo _cairo_surface_get_extents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service (application crash) via a crafted video.
nvdosv
CVE-2016-2827P4MEDIUMCVSS 6.5≤ 48.0.22016-09-22
CVE-2016-2827 [MEDIUM] CWE-125 CVE-2016-2827: The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attack
The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a Content Security Policy (CSP) referrer directive with zero values.
nvdosv
CVE-2016-5271P4MEDIUMCVSS 6.5≤ 48.0.22016-09-22
CVE-2016-5271 [MEDIUM] CWE-125 CVE-2016-5271: The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attac
The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a "display: contents" Cascading Style Sheets (CSS) property.
nvdosv