FI
Browser
Firefox
by Mozilla · last CVE Oct 6, 2026
On CISA KEVExploited in the wildRansomware-linked
3,445
CVEs
15
On KEV
10.0
Max CVSS
77
New 30D
Severity mix
Critical 489High 10Medium 1Low 0
Watch

Add Firefox to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-5731
9.8
0%
Apr 7
Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
Affected: 115.34.0; 140.9.0; 149.0.1
CVE-2026-4721
9.8
0%
Mar 24
Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Affected: before 115.34.0; before 149.0; 128.0 before 140.9.0
CVE-2026-4729
9.8
0%
Mar 24
Memory safety bugs fixed in Firefox 149 and Thunderbird 149
Affected: before 149.0
CVE-2026-4720
9.8
0%
Mar 24
Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Affected: before 140.9.0; before 149.0
CVE-2026-4717
9.8
0%
Mar 24
Privilege escalation in the Netmonitor component
Affected: before 140.9.0; before 149.0
CVE-2026-4711
9.8
0%
Mar 24
Use-after-free in the Widget: Cocoa component
Affected: before 140.9.0; before 149.0
CVE-2026-4710
9.8
0%
Mar 24
Incorrect boundary conditions in the Audio/Video component
Affected: before 140.9.0; before 149.0
CVE-2026-4705
9.8
1%
Mar 24
Undefined behavior in the WebRTC: Signaling component
Affected: before 140.9.0; before 149.0
CVE-2026-4723
9.8
1%
Mar 24
Use-after-free in the JavaScript Engine component
Affected: before 149.0
CVE-2026-4702
9.8
1%
Mar 24
JIT miscompilation in the JavaScript Engine component
Affected: before 140.9.0; before 149.0
CVE-2026-4701
9.8
0%
Mar 24
Use-after-free in the JavaScript Engine component
Affected: before 140.9.0; before 149.0
CVE-2026-4700
9.8
1%
Mar 24
Mitigation bypass in the Networking: HTTP component
Affected: before 140.9.0; before 149.0
CVE-2026-4698
9.8
1%
Mar 24
JIT miscompilation in the JavaScript Engine: JIT component
Affected: before 115.34.0; before 149.0; 128.0 before 140.9.0
CVE-2026-4696
9.8
1%
Mar 24
Use-after-free in the Layout: Text and Fonts component
Affected: before 115.34.0; before 149.0; 128.0 before 140.9.0
CVE-2026-4691
9.8
1%
Mar 24
Use-after-free in the CSS Parsing and Computation component
Affected: before 115.34.0; before 149.0; 128.0 before 140.9.0
CVE-2026-2807
9.8
0%
Feb 24
Memory safety bugs fixed in Firefox 148 and Thunderbird 148
Affected: before 148.0
CVE-2026-2805
9.8
1%
Feb 24
Invalid pointer in the DOM: Core & HTML component
Affected: before 148.0
CVE-2026-2800
9.8
0%
Feb 24
Spoofing issue in the WebAuthn component in Firefox for Android
Affected: before 148.0
CVE-2026-2799
9.8
1%
Feb 24
Use-after-free in the DOM: Core & HTML component
Affected: before 148.0
CVE-2026-2797
9.8
1%
Feb 24
Use-after-free in the JavaScript: GC component
Affected: before 148.0
CVE-2026-2796
9.8
1%
Feb 24
JIT miscompilation in the JavaScript: WebAssembly component
Affected: before 148.0
CVE-2026-2795
9.8
0%
Feb 24
Use-after-free in the JavaScript: GC component
Affected: before 148.0
CVE-2026-2634
9.8
0%
Feb 24
Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
Affected: before 147.4
CVE-2026-2793
9.8
0%
Feb 24
Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2792
9.8
0%
Feb 24
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Affected: before 140.8.0; before 148.0
CVE-2026-2791
9.8
1%
Feb 24
Mitigation bypass in the Networking: Cache component
Affected: before 140.8.0; before 148.0
CVE-2026-2790
9.8
0%
Feb 24
Same-origin policy bypass in the Networking: JAR component
Affected: before 140.8.0; before 148.0
CVE-2026-2789
9.8
1%
Feb 24
Use-after-free in the Graphics: ImageLib component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2788
9.8
1%
Feb 24
Incorrect boundary conditions in the Audio/Video: GMP component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2787
9.8
1%
Feb 24
Use-after-free in the DOM: Window and Location component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2786
9.8
1%
Feb 24
Use-after-free in the JavaScript Engine component
Affected: before 140.8.0; before 148.0
CVE-2026-2785
9.8
1%
Feb 24
Invalid pointer in the JavaScript Engine component
Affected: before 140.8.0; before 148.0
CVE-2026-2784
9.8
0%
Feb 24
Mitigation bypass in the DOM: Security component
Affected: before 140.8.0; before 148.0
CVE-2026-2782
9.8
0%
Feb 24
Privilege escalation in the Netmonitor component
Affected: before 140.8.0; before 148.0
CVE-2026-2781
9.8
0%
Feb 24
Integer overflow in the Libraries component in NSS
Affected: before 140.8.0; before 148.0
CVE-2026-2780
9.8
0%
Feb 24
Privilege escalation in the Netmonitor component
Affected: before 140.8.0; before 148.0
CVE-2026-2779
9.8
1%
Feb 24
Incorrect boundary conditions in the Networking: JAR component
Affected: before 140.8.0; before 148.0
CVE-2026-2777
9.8
0%
Feb 24
Privilege escalation in the Messaging System component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2775
9.8
1%
Feb 24
Mitigation bypass in the DOM: HTML Parser component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2774
9.8
1%
Feb 24
Integer overflow in the Audio/Video component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2773
9.8
1%
Feb 24
Incorrect boundary conditions in the Web Audio component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2772
9.8
1%
Feb 24
Use-after-free in the Audio/Video: Playback component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2771
9.8
1%
Feb 24
Undefined behavior in the DOM: Core & HTML component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2770
9.8
1%
Feb 24
Use-after-free in the DOM: Bindings (WebIDL) component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2767
9.8
0%
Feb 24
Use-after-free in the JavaScript: WebAssembly component
Affected: before 140.8.0; before 148.0
CVE-2026-2766
9.8
1%
Feb 24
Use-after-free in the JavaScript Engine: JIT component
Affected: before 140.8.0; before 148.0
CVE-2026-2765
9.8
1%
Feb 24
Use-after-free in the JavaScript Engine component
Affected: before 140.8.0; before 148.0
CVE-2026-2764
9.8
1%
Feb 24
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2763
9.8
1%
Feb 24
Use-after-free in the JavaScript Engine component
Affected: before 115.33.0; before 148.0; 128.0 before 140.8.0
CVE-2026-2762
9.8
1%
Feb 24
Integer overflow in the JavaScript: Standard Library component
Affected: before 140.8.0; before 148.0
Page 3 of 10 · 500 total
The 500 most important CVEs for this product (exploited first, then by severity)