RHSA-2026:10757

Vulnerability from csaf_redhat - Published: 2026-04-27 10:51 - Updated: 2026-04-28 01:32
Summary
Red Hat Security Advisory: firefox security update
Severity
Important
Notes
Topic: An update for firefox is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-6746

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6747

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6748

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video: Web Codecs component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-824 - Access of Uninitialized Pointer
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6749

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-824 - Access of Uninitialized Pointer
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6750

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Graphics: WebRender component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-266 - Incorrect Privilege Assignment
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6751

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video: Web Codecs component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-824 - Access of Uninitialized Pointer
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6752

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the WebRTC component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6753

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the WebRTC component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6754

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6757

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-823 - Use of Out-of-range Pointer Offset
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6759

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Widget: Cocoa component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-825 - Expired Pointer Dereference
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6761

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Networking component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-266 - Incorrect Privilege Assignment
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6762

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the DOM: Core & HTML component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6763

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the File Handling component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-66 - Improper Handling of File Names that Identify Virtual Resources
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6764

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the DOM: Device Interfaces component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-805 - Buffer Access with Incorrect Length Value
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6765

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Form Autofill component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6766

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Libraries component in NSS

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6767

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the Libraries component in NSS

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-676 - Use of Potentially Dangerous Function
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6769

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Debugger component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-266 - Incorrect Privilege Assignment
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6770

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the Storage: IndexedDB component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-440 - Expected Behavior Violation
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6771

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6772

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Libraries component in NSS

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-787 - Out-of-bounds Write
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6776

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the WebRTC: Networking component

3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CWE-131 - Incorrect Calculation of Buffer Size
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6785

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
CVE-2026-6786

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:10757
References
https://access.redhat.com/errata/RHSA-2026:10757 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2460074 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460075 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460076 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460078 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460079 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460085 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460086 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460088 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460092 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460094 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460095 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460096 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460097 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460099 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460101 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460102 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460103 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460104 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460105 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460106 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460107 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460108 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460109 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460110 external
https://bugzilla.redhat.com/show_bug.cgi?id=2460112 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-6746 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460112 external
https://www.cve.org/CVERecord?id=CVE-2026-6746 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6746 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6747 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460095 external
https://www.cve.org/CVERecord?id=CVE-2026-6747 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6747 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6748 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460103 external
https://www.cve.org/CVERecord?id=CVE-2026-6748 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6748 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6749 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460096 external
https://www.cve.org/CVERecord?id=CVE-2026-6749 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6749 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6750 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460102 external
https://www.cve.org/CVERecord?id=CVE-2026-6750 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6750 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6751 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460109 external
https://www.cve.org/CVERecord?id=CVE-2026-6751 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6751 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6752 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460078 external
https://www.cve.org/CVERecord?id=CVE-2026-6752 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6752 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6753 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460092 external
https://www.cve.org/CVERecord?id=CVE-2026-6753 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6753 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6754 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460075 external
https://www.cve.org/CVERecord?id=CVE-2026-6754 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6754 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6757 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460085 external
https://www.cve.org/CVERecord?id=CVE-2026-6757 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6757 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6759 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460094 external
https://www.cve.org/CVERecord?id=CVE-2026-6759 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6759 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6761 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460099 external
https://www.cve.org/CVERecord?id=CVE-2026-6761 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6761 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6762 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460076 external
https://www.cve.org/CVERecord?id=CVE-2026-6762 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6762 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6763 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460101 external
https://www.cve.org/CVERecord?id=CVE-2026-6763 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6763 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6764 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460106 external
https://www.cve.org/CVERecord?id=CVE-2026-6764 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6764 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6765 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460107 external
https://www.cve.org/CVERecord?id=CVE-2026-6765 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6765 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6766 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460097 external
https://www.cve.org/CVERecord?id=CVE-2026-6766 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6766 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6767 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460086 external
https://www.cve.org/CVERecord?id=CVE-2026-6767 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6767 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6769 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460108 external
https://www.cve.org/CVERecord?id=CVE-2026-6769 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6769 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6770 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460079 external
https://www.cve.org/CVERecord?id=CVE-2026-6770 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6770 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6771 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460105 external
https://www.cve.org/CVERecord?id=CVE-2026-6771 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6771 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6772 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460074 external
https://www.cve.org/CVERecord?id=CVE-2026-6772 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6772 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6776 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460110 external
https://www.cve.org/CVERecord?id=CVE-2026-6776 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6776 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6785 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460104 external
https://www.cve.org/CVERecord?id=CVE-2026-6785 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6785 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
https://access.redhat.com/security/cve/CVE-2026-6786 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460088 external
https://www.cve.org/CVERecord?id=CVE-2026-6786 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6786 external
https://www.mozilla.org/security/advisories/mfsa2… external
https://www.mozilla.org/security/advisories/mfsa2… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for firefox is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)\n\n* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)\n\n* firefox: thunderbird: Spoofing issue in the DOM: Core \u0026 HTML component (CVE-2026-6762)\n\n* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)\n\n* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)\n\n* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)\n\n* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)\n\n* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)\n\n* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)\n\n* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)\n\n* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)\n\n* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)\n\n* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)\n\n* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)\n\n* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)\n\n* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)\n\n* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)\n\n* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-6746)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:10757",
        "url": "https://access.redhat.com/errata/RHSA-2026:10757"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2460074",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460074"
      },
      {
        "category": "external",
        "summary": "2460075",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460075"
      },
      {
        "category": "external",
        "summary": "2460076",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460076"
      },
      {
        "category": "external",
        "summary": "2460078",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460078"
      },
      {
        "category": "external",
        "summary": "2460079",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460079"
      },
      {
        "category": "external",
        "summary": "2460085",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460085"
      },
      {
        "category": "external",
        "summary": "2460086",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460086"
      },
      {
        "category": "external",
        "summary": "2460088",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460088"
      },
      {
        "category": "external",
        "summary": "2460092",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460092"
      },
      {
        "category": "external",
        "summary": "2460094",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460094"
      },
      {
        "category": "external",
        "summary": "2460095",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460095"
      },
      {
        "category": "external",
        "summary": "2460096",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460096"
      },
      {
        "category": "external",
        "summary": "2460097",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460097"
      },
      {
        "category": "external",
        "summary": "2460099",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460099"
      },
      {
        "category": "external",
        "summary": "2460101",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460101"
      },
      {
        "category": "external",
        "summary": "2460102",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460102"
      },
      {
        "category": "external",
        "summary": "2460103",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460103"
      },
      {
        "category": "external",
        "summary": "2460104",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460104"
      },
      {
        "category": "external",
        "summary": "2460105",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460105"
      },
      {
        "category": "external",
        "summary": "2460106",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460106"
      },
      {
        "category": "external",
        "summary": "2460107",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460107"
      },
      {
        "category": "external",
        "summary": "2460108",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460108"
      },
      {
        "category": "external",
        "summary": "2460109",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460109"
      },
      {
        "category": "external",
        "summary": "2460110",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460110"
      },
      {
        "category": "external",
        "summary": "2460112",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460112"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10757.json"
      }
    ],
    "title": "Red Hat Security Advisory: firefox security update",
    "tracking": {
      "current_release_date": "2026-04-28T01:32:00+00:00",
      "generator": {
        "date": "2026-04-28T01:32:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:10757",
      "initial_release_date": "2026-04-27T10:51:33+00:00",
      "revision_history": [
        {
          "date": "2026-04-27T10:51:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-27T10:51:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-28T01:32:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.7.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.10.0-1.el9_7.src",
                "product": {
                  "name": "firefox-0:140.10.0-1.el9_7.src",
                  "product_id": "firefox-0:140.10.0-1.el9_7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.10.0-1.el9_7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.10.0-1.el9_7.aarch64",
                "product": {
                  "name": "firefox-0:140.10.0-1.el9_7.aarch64",
                  "product_id": "firefox-0:140.10.0-1.el9_7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.10.0-1.el9_7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.10.0-1.el9_7.aarch64",
                "product": {
                  "name": "firefox-x11-0:140.10.0-1.el9_7.aarch64",
                  "product_id": "firefox-x11-0:140.10.0-1.el9_7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.10.0-1.el9_7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
                "product": {
                  "name": "firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
                  "product_id": "firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.10.0-1.el9_7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
                "product": {
                  "name": "firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
                  "product_id": "firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.10.0-1.el9_7?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.10.0-1.el9_7.ppc64le",
                "product": {
                  "name": "firefox-0:140.10.0-1.el9_7.ppc64le",
                  "product_id": "firefox-0:140.10.0-1.el9_7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.10.0-1.el9_7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.10.0-1.el9_7.ppc64le",
                "product": {
                  "name": "firefox-x11-0:140.10.0-1.el9_7.ppc64le",
                  "product_id": "firefox-x11-0:140.10.0-1.el9_7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.10.0-1.el9_7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
                "product": {
                  "name": "firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
                  "product_id": "firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.10.0-1.el9_7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
                "product": {
                  "name": "firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
                  "product_id": "firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.10.0-1.el9_7?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.10.0-1.el9_7.x86_64",
                "product": {
                  "name": "firefox-0:140.10.0-1.el9_7.x86_64",
                  "product_id": "firefox-0:140.10.0-1.el9_7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.10.0-1.el9_7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.10.0-1.el9_7.x86_64",
                "product": {
                  "name": "firefox-x11-0:140.10.0-1.el9_7.x86_64",
                  "product_id": "firefox-x11-0:140.10.0-1.el9_7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.10.0-1.el9_7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
                "product": {
                  "name": "firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
                  "product_id": "firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.10.0-1.el9_7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
                "product": {
                  "name": "firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
                  "product_id": "firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.10.0-1.el9_7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.10.0-1.el9_7.s390x",
                "product": {
                  "name": "firefox-0:140.10.0-1.el9_7.s390x",
                  "product_id": "firefox-0:140.10.0-1.el9_7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.10.0-1.el9_7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.10.0-1.el9_7.s390x",
                "product": {
                  "name": "firefox-x11-0:140.10.0-1.el9_7.s390x",
                  "product_id": "firefox-x11-0:140.10.0-1.el9_7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.10.0-1.el9_7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.10.0-1.el9_7.s390x",
                "product": {
                  "name": "firefox-debugsource-0:140.10.0-1.el9_7.s390x",
                  "product_id": "firefox-debugsource-0:140.10.0-1.el9_7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.10.0-1.el9_7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
                "product": {
                  "name": "firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
                  "product_id": "firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.10.0-1.el9_7?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.10.0-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64"
        },
        "product_reference": "firefox-0:140.10.0-1.el9_7.aarch64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.10.0-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le"
        },
        "product_reference": "firefox-0:140.10.0-1.el9_7.ppc64le",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.10.0-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x"
        },
        "product_reference": "firefox-0:140.10.0-1.el9_7.s390x",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.10.0-1.el9_7.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src"
        },
        "product_reference": "firefox-0:140.10.0-1.el9_7.src",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.10.0-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64"
        },
        "product_reference": "firefox-0:140.10.0-1.el9_7.x86_64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.10.0-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64"
        },
        "product_reference": "firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.10.0-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.10.0-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.10.0-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64"
        },
        "product_reference": "firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.10.0-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le"
        },
        "product_reference": "firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.10.0-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x"
        },
        "product_reference": "firefox-debugsource-0:140.10.0-1.el9_7.s390x",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.10.0-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64"
        },
        "product_reference": "firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.10.0-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64"
        },
        "product_reference": "firefox-x11-0:140.10.0-1.el9_7.aarch64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.10.0-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le"
        },
        "product_reference": "firefox-x11-0:140.10.0-1.el9_7.ppc64le",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.10.0-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x"
        },
        "product_reference": "firefox-x11-0:140.10.0-1.el9_7.s390x",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.10.0-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        },
        "product_reference": "firefox-x11-0:140.10.0-1.el9_7.x86_64",
        "relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6746",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-21T14:03:11.980101+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460112"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6746"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460112",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460112"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6746",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6746"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6746",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6746"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6746",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6746"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6746",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6746"
        }
      ],
      "release_date": "2026-04-21T12:40:44.148000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-6747",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-21T14:02:14.211992+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460095"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the WebRTC component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the WebRTC component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6747"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460095",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460095"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6747",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6747"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6747",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6747"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6747",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6747"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6747",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6747"
        }
      ],
      "release_date": "2026-04-21T12:40:45.203000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the WebRTC component"
    },
    {
      "cve": "CVE-2026-6748",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-04-21T14:02:39.417505+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460103"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUninitialized memory in the Audio/Video: Web Codecs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6748"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460103",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460103"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6748"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6748",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6748"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6748",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6748"
        }
      ],
      "release_date": "2026-04-21T12:40:45.923000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component"
    },
    {
      "cve": "CVE-2026-6749",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-04-21T14:02:17.294680+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460096"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure due to uninitialized memory in the Graphics: Canvas2D component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6749"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460096",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460096"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6749"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6749",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6749"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6749",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6749"
        }
      ],
      "release_date": "2026-04-21T12:40:46.800000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component"
    },
    {
      "cve": "CVE-2026-6750",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-04-21T14:02:36.284791+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460102"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6750"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460102",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460102"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6750",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6750"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6750",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6750"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6750",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6750"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6750",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6750"
        }
      ],
      "release_date": "2026-04-21T12:40:47.476000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-6751",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-04-21T14:02:59.801592+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460109"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUninitialized memory in the Audio/Video: Web Codecs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6751"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460109",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460109"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6751",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6751"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6751",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6751"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6751",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6751"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6751",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6751"
        }
      ],
      "release_date": "2026-04-21T12:40:48.315000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component"
    },
    {
      "cve": "CVE-2026-6752",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-21T14:01:16.112992+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460078"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the WebRTC component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6752"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460078",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460078"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6752",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6752"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6752",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6752"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6752",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6752"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6752",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6752"
        }
      ],
      "release_date": "2026-04-21T12:40:49.079000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC component"
    },
    {
      "cve": "CVE-2026-6753",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-04-21T14:02:04.165668+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460092"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the WebRTC component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6753"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460092",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460092"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6753",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6753"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6753",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6753"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6753",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6753"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6753",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6753"
        }
      ],
      "release_date": "2026-04-21T12:40:49.893000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC component"
    },
    {
      "cve": "CVE-2026-6754",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-21T14:01:06.088921+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460075"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript Engine component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript Engine component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6754"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460075",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460075"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6754",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6754"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6754",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6754"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6754",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6754"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6754",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6754"
        }
      ],
      "release_date": "2026-04-21T12:40:50.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript Engine component"
    },
    {
      "cve": "CVE-2026-6757",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "discovery_date": "2026-04-21T14:01:38.621666+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInvalid pointer in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6757",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6757",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6757"
        }
      ],
      "release_date": "2026-04-21T12:40:52.961000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-6759",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-21T14:02:11.211234+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460094"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Widget: Cocoa component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Widget: Cocoa component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6759"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460094",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460094"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6759",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6759",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6759"
        }
      ],
      "release_date": "2026-04-21T12:40:54.329000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Widget: Cocoa component"
    },
    {
      "cve": "CVE-2026-6761",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-04-21T14:02:27.081570+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460099"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6761"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460099",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460099"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6761",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6761"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6761",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6761"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6761",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6761"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6761",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6761"
        }
      ],
      "release_date": "2026-04-21T12:40:56.138000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Networking component"
    },
    {
      "cve": "CVE-2026-6762",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "discovery_date": "2026-04-21T14:01:09.931598+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460076"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSpoofing issue in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Spoofing issue in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6762"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460076",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460076"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6762",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6762",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6762"
        }
      ],
      "release_date": "2026-04-21T12:40:56.838000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Spoofing issue in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-6763",
      "cwe": {
        "id": "CWE-66",
        "name": "Improper Handling of File Names that Identify Virtual Resources"
      },
      "discovery_date": "2026-04-21T14:02:33.290450+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460101"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the File Handling component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the File Handling component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6763"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460101",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460101"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6763"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6763",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6763"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6763",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6763"
        }
      ],
      "release_date": "2026-04-21T12:40:57.591000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the File Handling component"
    },
    {
      "cve": "CVE-2026-6764",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-04-21T14:02:49.779121+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460106"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the DOM: Device Interfaces component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6764"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460106",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460106"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6764",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6764"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6764",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6764"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6764",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6764"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6764",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6764"
        }
      ],
      "release_date": "2026-04-21T12:40:58.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component"
    },
    {
      "cve": "CVE-2026-6765",
      "cwe": {
        "id": "CWE-359",
        "name": "Exposure of Private Personal Information to an Unauthorized Actor"
      },
      "discovery_date": "2026-04-21T14:02:53.497922+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460107"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Form Autofill component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Form Autofill component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6765"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460107",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460107"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6765",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6765"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6765",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6765"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6765",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6765"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6765",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6765"
        }
      ],
      "release_date": "2026-04-21T12:40:58.955000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Form Autofill component"
    },
    {
      "cve": "CVE-2026-6766",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-21T14:02:20.449802+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460097"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Libraries component in NSS",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6766"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460097",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460097"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6766",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6766"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6766",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6766"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6766",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6766"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6766",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6766"
        }
      ],
      "release_date": "2026-04-21T12:40:59.634000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS"
    },
    {
      "cve": "CVE-2026-6767",
      "cwe": {
        "id": "CWE-676",
        "name": "Use of Potentially Dangerous Function"
      },
      "discovery_date": "2026-04-21T14:01:41.899767+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460086"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nOther issue in the Libraries component in NSS",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Other issue in the Libraries component in NSS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6767"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460086",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460086"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6767",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6767"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6767",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6767"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6767",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6767"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6767",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6767"
        }
      ],
      "release_date": "2026-04-21T12:41:00.326000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Other issue in the Libraries component in NSS"
    },
    {
      "cve": "CVE-2026-6769",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-04-21T14:02:56.672831+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460108"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Debugger component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Debugger component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6769"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460108",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460108"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6769",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6769"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6769",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6769"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6769",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6769"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6769",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6769"
        }
      ],
      "release_date": "2026-04-21T12:41:02.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Debugger component"
    },
    {
      "cve": "CVE-2026-6770",
      "cwe": {
        "id": "CWE-440",
        "name": "Expected Behavior Violation"
      },
      "discovery_date": "2026-04-21T14:01:19.807829+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460079"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nOther issue in the Storage: IndexedDB component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Other issue in the Storage: IndexedDB component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460079",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460079"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6770"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6770",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6770"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6770",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6770"
        }
      ],
      "release_date": "2026-04-21T12:41:03.257000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Other issue in the Storage: IndexedDB component"
    },
    {
      "cve": "CVE-2026-6771",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-04-21T14:02:46.714855+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460105"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: Security component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the DOM: Security component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6771"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460105",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460105"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6771",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6771"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6771",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6771"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6771",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6771"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6771",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6771"
        }
      ],
      "release_date": "2026-04-21T12:41:03.920000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the DOM: Security component"
    },
    {
      "cve": "CVE-2026-6772",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-04-21T14:01:02.407659+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460074"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Libraries component in NSS",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6772"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460074",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460074"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6772",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6772"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6772",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6772"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6772",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6772"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6772",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6772"
        }
      ],
      "release_date": "2026-04-21T12:41:04.596000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS"
    },
    {
      "cve": "CVE-2026-6776",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-21T14:03:05.225960+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460110"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the WebRTC: Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460110",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460110"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6776"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6776",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6776"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6776",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6776"
        }
      ],
      "release_date": "2026-04-21T12:41:07.745000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component"
    },
    {
      "cve": "CVE-2026-6785",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-04-21T14:02:42.672787+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460104"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6785"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460104",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460104"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6785",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6785"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6785",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6785"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6785",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6785"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6785",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6785"
        }
      ],
      "release_date": "2026-04-21T12:41:13.980000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150"
    },
    {
      "cve": "CVE-2026-6786",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-04-21T14:01:48.769542+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460088"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
          "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
          "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460088",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460088"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6786"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6786",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/#CVE-2026-6786"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6786",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/#CVE-2026-6786"
        }
      ],
      "release_date": "2026-04-21T12:41:14.629000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-27T10:51:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10757"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.src",
            "AppStream-9.7.0.Z.MAIN:firefox-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debuginfo-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-debugsource-0:140.10.0-1.el9_7.x86_64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.aarch64",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.ppc64le",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.s390x",
            "AppStream-9.7.0.Z.MAIN:firefox-x11-0:140.10.0-1.el9_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.