| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-92077 | 0.00 | — | — | Sep 15, 2026 | Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92076 | 0.00 | — | — | Sep 15, 2026 | Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92075 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92074 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92073 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92072 | 0.00 | — | — | Sep 15, 2026 | Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92071 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92070 | 0.00 | — | — | Sep 15, 2026 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92069 | 0.00 | — | — | Sep 15, 2026 | Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92068 | 0.00 | — | — | Sep 15, 2026 | Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92067 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92066 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92065 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92064 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92063 | 0.00 | — | — | Sep 15, 2026 | Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92062 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92061 | 0.00 | — | — | Sep 15, 2026 | Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92060 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92059 | 0.00 | — | — | Sep 15, 2026 | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92058 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92057 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92056 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92055 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92054 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92053 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92052 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92051 | 0.00 | — | — | Sep 15, 2026 | Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92050 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92049 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92048 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92047 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92046 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92045 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92044 | 0.00 | — | — | Sep 15, 2026 | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92043 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | ||
| CVE-2026-92042 | 0.00 | — | — | Sep 15, 2026 | Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92041 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92040 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92039 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92038 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92037 | 0.00 | — | — | Sep 15, 2026 | Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92036 | 0.00 | — | — | Sep 15, 2026 | Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92035 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||
| CVE-2026-92034 | 0.00 | — | — | Sep 15, 2026 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | |||
| CVE-2026-92033 | Hig | 0.57 | 8.8 | — | Sep 15, 2026 | Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156. | ||
| CVE-2026-92032 | 0.00 | — | — | Sep 15, 2026 | Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. | |||
| CVE-2026-92031 | 0.00 | — | — | Sep 15, 2026 | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. | |||
| CVE-2026-92030 | 0.00 | — | — | Sep 15, 2026 | Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. | |||
| CVE-2026-92029 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. | |||
| CVE-2026-92028 | 0.00 | — | — | Sep 15, 2026 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. |
- CVE-2026-92077Sep 15, 2026risk 0.00cvss —epss —
Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92076Sep 15, 2026risk 0.00cvss —epss —
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92075Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92074Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92072Sep 15, 2026risk 0.00cvss —epss —
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92071Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92070Sep 15, 2026risk 0.00cvss —epss —
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92069Sep 15, 2026risk 0.00cvss —epss —
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92068Sep 15, 2026risk 0.00cvss —epss —
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92067Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92066Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92065Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92064Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92063Sep 15, 2026risk 0.00cvss —epss —
Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92061Sep 15, 2026risk 0.00cvss —epss —
Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92060Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92059Sep 15, 2026risk 0.00cvss —epss —
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92058Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92057Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92056Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92051Sep 15, 2026risk 0.00cvss —epss —
Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92050Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92049Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92048Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92046Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92045Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92044Sep 15, 2026risk 0.00cvss —epss —
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92042Sep 15, 2026risk 0.00cvss —epss —
Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92041Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92040Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92039Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92038Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92037Sep 15, 2026risk 0.00cvss —epss —
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92036Sep 15, 2026risk 0.00cvss —epss —
Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92035Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.
- CVE-2026-92034Sep 15, 2026risk 0.00cvss —epss —
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
- risk 0.57cvss 8.8epss —
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.
- CVE-2026-92032Sep 15, 2026risk 0.00cvss —epss —
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
- CVE-2026-92031Sep 15, 2026risk 0.00cvss —epss —
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
- CVE-2026-92030Sep 15, 2026risk 0.00cvss —epss —
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
- CVE-2026-92029Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.
- CVE-2026-92028Sep 15, 2026risk 0.00cvss —epss —
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.