Mozilla Firefox Esr vulnerabilities
1,297 known vulnerabilities affecting mozilla/firefox_esr.
Total CVEs
1,297
CISA KEV
9
actively exploited
Public exploits
20
Exploited in wild
16
Severity breakdown
CRITICAL214HIGH400MEDIUM327LOW6UNKNOWN350
Vulnerabilities
Page 5 of 65
CVE-2026-12327P3HIGHCVSS 7.3fixed in Firefox ESR 140.12
CVE-2026-12327 [HIGH] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12327
Mozilla Foundation Security Advisory 2026-58
CVE: CVE-2026-12327
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.12
mozilla
CVE-2026-16363P3UNKNOWNfixed in Firefox ESR 140.13
CVE-2026-16363 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16363
Mozilla Foundation Security Advisory 2026-70
CVE: CVE-2026-16363
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.13
mozilla
CVE-2026-74940P3UNKNOWNfixed in Firefox ESR 115.39
CVE-2026-74940 Mozilla Foundation Security Advisory 2026-75: CVE-2026-74940
Mozilla Foundation Security Advisory 2026-75
CVE: CVE-2026-74940
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.39
mozilla
CVE-2026-16357P3UNKNOWNfixed in Firefox ESR 115.38
CVE-2026-16357 Mozilla Foundation Security Advisory 2026-69: CVE-2026-16357
Mozilla Foundation Security Advisory 2026-69
CVE: CVE-2026-16357
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.38
mozilla
CVE-2026-74944P3UNKNOWNfixed in Firefox ESR 153.1
CVE-2026-74944 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74944
Mozilla Foundation Security Advisory 2026-77
CVE: CVE-2026-74944
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 153.1
mozilla
CVE-2026-74936P3UNKNOWNfixed in Firefox ESR 140.14
CVE-2026-74936 Mozilla Foundation Security Advisory 2026-76: CVE-2026-74936
Mozilla Foundation Security Advisory 2026-76
CVE: CVE-2026-74936
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.14
mozilla
CVE-2026-16377P3UNKNOWNfixed in Firefox ESR 140.13
CVE-2026-16377 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16377
Mozilla Foundation Security Advisory 2026-70
CVE: CVE-2026-16377
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.13
mozilla
CVE-2026-16390P3UNKNOWNfixed in Firefox ESR 140.13
CVE-2026-16390 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16390
Mozilla Foundation Security Advisory 2026-70
CVE: CVE-2026-16390
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.13
mozilla
CVE-2026-109708P3CRITICALCVSS 9.6fixed in Firefox ESR 153.5
CVE-2026-109708 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109708
Mozilla Foundation Security Advisory 2026-108
CVE: CVE-2026-109708
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 153.5
mozilla
CVE-2026-84121P3CRITICALCVSS 9.6fixed in Firefox ESR 140.15
CVE-2026-84121 [CRITICAL] Mozilla Foundation Security Advisory 2026-84: CVE-2026-84121
Mozilla Foundation Security Advisory 2026-84
CVE: CVE-2026-84121
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.15
mozilla
CVE-2026-92038P3UNKNOWNfixed in Firefox ESR 153.3
CVE-2026-92038 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92038
Mozilla Foundation Security Advisory 2026-93
CVE: CVE-2026-92038
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 153.3
mozilla
CVE-2026-16349P3UNKNOWNfixed in Firefox ESR 115.38
CVE-2026-16349 Mozilla Foundation Security Advisory 2026-69: CVE-2026-16349
Mozilla Foundation Security Advisory 2026-69
CVE: CVE-2026-16349
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.38
mozilla
CVE-2026-100800P3CRITICALCVSS 9.6fixed in Firefox ESR 153.4
CVE-2026-100800 [CRITICAL] Mozilla Foundation Security Advisory 2026-100: CVE-2026-100800
Mozilla Foundation Security Advisory 2026-100
CVE: CVE-2026-100800
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 153.4
mozilla
CVE-2026-84133P3UNKNOWNfixed in Firefox ESR 153.2
CVE-2026-84133 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84133
Mozilla Foundation Security Advisory 2026-85
CVE: CVE-2026-84133
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 153.2
mozilla
CVE-2026-84129P3UNKNOWNfixed in Firefox ESR 153.2
CVE-2026-84129 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84129
Mozilla Foundation Security Advisory 2026-85
CVE: CVE-2026-84129
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 153.2
mozilla
CVE-2026-84140P3UNKNOWNfixed in Firefox ESR 153.2
CVE-2026-84140 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84140
Mozilla Foundation Security Advisory 2026-85
CVE: CVE-2026-84140
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 153.2
mozilla
CVE-2024-2614P3HIGHCVSS 8.8≥ unspecified, < 115.92024-03-19
CVE-2024-2614 [HIGH] CWE-787 CVE-2024-2614: Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these b
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
nvd
CVE-2024-3854P3HIGHCVSS 8.8≥ unspecified, < 115.102024-04-16
CVE-2024-3854 [HIGH] CWE-125 CVE-2024-3854: In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
nvd
CVE-2018-18498P3CRITICALCVSS 9.8fixed in 60.4≥ unspecified, < 60.42019-02-28
CVE-2018-18498 [CRITICAL] CWE-190 CVE-2018-18498: A potential vulnerability leading to an integer overflow can occur during buffer size calculations f
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
nvd
CVE-2022-46872P3HIGHCVSS 8.6fixed in 102.6≥ unspecified, < 102.62022-12-22
CVE-2022-46872 [HIGH] CWE-125 CVE-2022-46872: An attacker who compromised a content process could have partially escaped the sandbox to read arbit
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
nvd