Mozilla Firefox Esr vulnerabilities
1,297 known vulnerabilities affecting mozilla/firefox_esr.
Total CVEs
1,297
CISA KEV
9
actively exploited
Public exploits
20
Exploited in wild
16
Severity breakdown
CRITICAL214HIGH400MEDIUM327LOW6UNKNOWN350
Vulnerabilities
Page 28 of 65
CVE-2026-6746P3HIGHCVSS 7.5fixed in Firefox ESR 140.10
CVE-2026-6746 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6746
Mozilla Foundation Security Advisory 2026-32
CVE: CVE-2026-6746
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.10
mozilla
CVE-2024-10466P3HIGHCVSS 7.5≥ unspecified, < 128.42024-10-29
CVE-2024-10466 [HIGH] CWE-400 CVE-2024-10466: By sending a specially crafted push message, a remote server could have hung the parent process, cau
By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
nvd
CVE-2026-8949P3HIGHCVSS 7.5fixed in Firefox ESR 140.11
CVE-2026-8949 [HIGH] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8949
Mozilla Foundation Security Advisory 2026-48
CVE: CVE-2026-8949
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.11
mozilla
CVE-2026-8946P3HIGHCVSS 7.5fixed in Firefox ESR 115.36
CVE-2026-8946 [HIGH] Mozilla Foundation Security Advisory 2026-47: CVE-2026-8946
Mozilla Foundation Security Advisory 2026-47
CVE: CVE-2026-8946
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.36
mozilla
CVE-2026-16405P3HIGHCVSS 7.5fixed in Firefox ESR 140.13
CVE-2026-16405 [HIGH] Mozilla Foundation Security Advisory 2026-70: CVE-2026-16405
Mozilla Foundation Security Advisory 2026-70
CVE: CVE-2026-16405
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.13
mozilla
CVE-2026-8954P3HIGHCVSS 7.5fixed in Firefox ESR 140.11
CVE-2026-8954 [HIGH] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8954
Mozilla Foundation Security Advisory 2026-48
CVE: CVE-2026-8954
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.11
mozilla
CVE-2026-6749P3HIGHCVSS 7.5fixed in Firefox ESR 115.35
CVE-2026-6749 [HIGH] Mozilla Foundation Security Advisory 2026-31: CVE-2026-6749
Mozilla Foundation Security Advisory 2026-31
CVE: CVE-2026-6749
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.35
mozilla
CVE-2026-84145P3HIGHCVSS 7.5fixed in Firefox ESR 153.2
CVE-2026-84145 [HIGH] Mozilla Foundation Security Advisory 2026-85: CVE-2026-84145
Mozilla Foundation Security Advisory 2026-85
CVE: CVE-2026-84145
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 153.2
mozilla
CVE-2026-6759P3HIGHCVSS 7.5fixed in Firefox ESR 140.10
CVE-2026-6759 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6759
Mozilla Foundation Security Advisory 2026-32
CVE: CVE-2026-6759
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.10
mozilla
CVE-2018-12360P3HIGHCVSS 8.8fixed in 52.9≥ unspecified, < 60.1+1 more2018-10-18
CVE-2018-12360 [HIGH] CWE-416 CVE-2018-12360: A use-after-free vulnerability can occur when deleting an input element during a mutation event hand
A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
nvd
CVE-2015-2725P3CRITICALCVSS 10.0v31.1v31.2+5 more2015-07-06
CVE-2015-2725 [CRITICAL] CWE-119 CVE-2015-2725: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox E
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
nvd
CVE-2015-2724P3CRITICALCVSS 10.0v31.1v31.2+5 more2015-07-06
CVE-2015-2724 [CRITICAL] CWE-119 CVE-2015-2724: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox E
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
nvd
CVE-2018-12361P3HIGHCVSS 8.8fixed in 60.1≥ unspecified, < 60.12018-10-18
CVE-2018-12361 [HIGH] CWE-190 CVE-2018-12361: An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed
An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
nvd
CVE-2020-6806P3HIGHCVSS 8.8fixed in 68.6.0≥ unspecified, < 68.62020-03-25
CVE-2020-6806 [HIGH] CWE-125 CVE-2020-6806: By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the en
By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
nvd
CVE-2026-6751P3HIGHCVSS 7.3fixed in Firefox ESR 140.10
CVE-2026-6751 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6751
Mozilla Foundation Security Advisory 2026-32
CVE: CVE-2026-6751
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.10
mozilla
CVE-2026-12324P3HIGHCVSS 7.3fixed in Firefox ESR 140.12
CVE-2026-12324 [HIGH] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12324
Mozilla Foundation Security Advisory 2026-58
CVE: CVE-2026-12324
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.12
mozilla
CVE-2026-16379P3UNKNOWNfixed in Firefox ESR 140.13
CVE-2026-16379 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16379
Mozilla Foundation Security Advisory 2026-70
CVE: CVE-2026-16379
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.13
mozilla
CVE-2026-109730P3UNKNOWNfixed in Firefox ESR 115.43
CVE-2026-109730 Mozilla Foundation Security Advisory 2026-107: CVE-2026-109730
Mozilla Foundation Security Advisory 2026-107
CVE: CVE-2026-109730
Product: Firefox ESR
Impact: moderate
Fixed in: Firefox ESR 115.43
mozilla
CVE-2026-109734P3UNKNOWNfixed in Firefox ESR 153.5
CVE-2026-109734 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109734
Mozilla Foundation Security Advisory 2026-108
CVE: CVE-2026-109734
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 153.5
mozilla
CVE-2026-109782P3UNKNOWNfixed in Firefox ESR 153.5
CVE-2026-109782 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109782
Mozilla Foundation Security Advisory 2026-108
CVE: CVE-2026-109782
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 153.5
mozilla