Vulnerability-Lookup

WID-SEC-W-2026-1228

Vulnerability from csaf_certbund - Published: 2026-04-21 22:00 - Updated: 2026-05-20 22:00

Summary

Mozilla Thunderbird, Firefox ESR und Firefox: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Thunderbird ist ein Open Source E-Mail Client. Firefox ist ein Open Source Web Browser.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird, Mozilla Firefox ESR und Mozilla Firefox ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um falsche Informationen darzustellen, und um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-2781

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-33626

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6746

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6747

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6748

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6749

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6750

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6751

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6752

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6753

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6754

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6755

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6756

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6757

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6758

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6759

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6760

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6761

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6762

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6763

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6764

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6765

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6766

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6767

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6768

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6769

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6770

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6771

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6772

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6773

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6774

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6775

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6776

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6777

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6778

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6779

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6780

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6781

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6782

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6783

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6784

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6785

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

CVE-2026-6786

Affected products

Known affected 13 products

Product	Identifier	Version
Mozilla Firefox <150 Mozilla / Firefox		<150
Red Hat Enterprise Linux 8.8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:8.8`	8.8
Mozilla Firefox ESR <140.10 Mozilla / Firefox ESR		<140.10
Mozilla Firefox ESR <115.35 Mozilla / Firefox ESR		<115.35
Mozilla Thunderbird <140.10 Mozilla / Thunderbird		<140.10
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Mozilla Thunderbird <150 Mozilla / Thunderbird		<150
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:-`	—
RESF Rocky Linux 9 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:9`	9
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—

References

60 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://www.mozilla.org/en-US/security/advisories…	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6748	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6750	external
https://lists.opensuse.org/archives/list/security…	external
https://security-tracker.debian.org/tracker/DSA-6229-1	external
https://lists.debian.org/debian-lts-announce/2026…	external
https://access.redhat.com/errata/RHSA-2026:10757	external
https://linux.oracle.com/errata/ELSA-2026-10767.html	external
https://access.redhat.com/errata/RHSA-2026:10767	external
https://lists.opensuse.org/archives/list/security…	external
https://linux.oracle.com/errata/ELSA-2026-10757.html	external
https://access.redhat.com/errata/RHSA-2026:10766	external
https://linux.oracle.com/errata/ELSA-2026-10766.html	external
https://errata.build.resf.org/RLSA-2026:10767	external
https://errata.build.resf.org/RLSA-2026:10757	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://linux.oracle.com/errata/ELSA-2026-12285.html	external
https://errata.build.resf.org/RLSA-2026:10766	external
https://access.redhat.com/errata/RHSA-2026:12285	external
https://access.redhat.com/errata/RHSA-2026:13537	external
https://lists.opensuse.org/archives/list/security…	external
https://linux.oracle.com/errata/ELSA-2026-13537.html	external
https://errata.build.resf.org/RLSA-2026:13537	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://errata.build.resf.org/RLSA-2026:12285	external
https://access.redhat.com/errata/RHSA-2026:15892	external
https://linux.oracle.com/errata/ELSA-2026-15892.html	external
https://access.redhat.com/errata/RHSA-2026:17689	external
https://access.redhat.com/errata/RHSA-2026:17688	external
https://access.redhat.com/errata/RHSA-2026:17687	external
https://access.redhat.com/errata/RHSA-2026:17477	external
https://errata.build.resf.org/RLSA-2026:15892	external
https://access.redhat.com/errata/RHSA-2026:17690	external
https://github.com/rootdirective-sec/CVE-2026-33626-Lab	external
https://access.redhat.com/errata/RHSA-2026:19466	external
https://access.redhat.com/errata/RHSA-2026:19041	external
https://access.redhat.com/errata/RHSA-2026:19201	external
https://access.redhat.com/errata/RHSA-2026:19131	external
https://access.redhat.com/errata/RHSA-2026:19461	external
https://access.redhat.com/errata/RHSA-2026:19462	external
https://access.redhat.com/errata/RHSA-2026:19465	external
https://access.redhat.com/errata/RHSA-2026:19467	external
https://errata.build.resf.org/RLSA-2026:19201	external
https://access.redhat.com/errata/RHSA-2026:19348	external
https://access.redhat.com/errata/RHSA-2026:19464	external
https://access.redhat.com/errata/RHSA-2026:19468	external
https://access.redhat.com/errata/RHSA-2026:19542	external
https://access.redhat.com/errata/RHSA-2026:19469	external
https://access.redhat.com/errata/RHSA-2026:19463	external
https://access.redhat.com/errata/RHSA-2026:19655	external
https://access.redhat.com/errata/RHSA-2026:19704	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Thunderbird ist ein Open Source E-Mail Client.\r\nFirefox ist ein Open Source Web Browser.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird, Mozilla Firefox ESR und Mozilla Firefox ausnutzen, um seine Privilegien zu erh\u00f6hen, um einen Denial of Service Angriff durchzuf\u00fchren, um Informationen offenzulegen, um falsche Informationen darzustellen, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1228 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1228.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1228 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1228"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-30 vom 2026-04-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-31 vom 2026-04-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-31/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-32 vom 2026-04-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-32"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-33 vom 2026-04-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-33/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory mfsa2026-34 vom 2026-04-21",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-34/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4546 vom 2026-04-23",
        "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00027.html"
      },
      {
        "category": "external",
        "summary": "National Vulnerability Database CVE-2026-6748 vom 2026-04-22",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6748"
      },
      {
        "category": "external",
        "summary": "National Vulnerability Database CVE-2026-6750 vom 2026-04-22",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6750"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:10610-1 vom 2026-04-25",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6VX2E6MLQKO7DPWQ4ZZHUP2YTTOARCJ2/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6229 vom 2026-04-24",
        "url": "https://security-tracker.debian.org/tracker/DSA-6229-1"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4549 vom 2026-04-26",
        "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00030.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:10757 vom 2026-04-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:10757"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-10767 vom 2026-04-28",
        "url": "https://linux.oracle.com/errata/ELSA-2026-10767.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:10767 vom 2026-04-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:10767"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:20621-1 vom 2026-04-27",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6A4NBNRGRAA5IER7QAALUZTRHLEXIBXW/"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-10757 vom 2026-04-28",
        "url": "https://linux.oracle.com/errata/ELSA-2026-10757.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:10766 vom 2026-04-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:10766"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-10766 vom 2026-04-28",
        "url": "https://linux.oracle.com/errata/ELSA-2026-10766.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:10767 vom 2026-04-28",
        "url": "https://errata.build.resf.org/RLSA-2026:10767"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:10757 vom 2026-04-28",
        "url": "https://errata.build.resf.org/RLSA-2026:10757"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:21383-1 vom 2026-04-28",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025725.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1649-1 vom 2026-04-29",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025757.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1650-1 vom 2026-04-29",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025756.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-12285 vom 2026-05-01",
        "url": "https://linux.oracle.com/errata/ELSA-2026-12285.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:10766 vom 2026-04-30",
        "url": "https://errata.build.resf.org/RLSA-2026:10766"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:12285 vom 2026-04-30",
        "url": "https://access.redhat.com/errata/RHSA-2026:12285"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:13537 vom 2026-05-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:13537"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2026:20664-1 vom 2026-05-04",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VYPE5WKCCCIM4I2XJFAO2S7QLLSWQCSW/"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-13537 vom 2026-05-06",
        "url": "https://linux.oracle.com/errata/ELSA-2026-13537.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:13537 vom 2026-05-07",
        "url": "https://errata.build.resf.org/RLSA-2026:13537"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1741-1 vom 2026-05-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/025930.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:12285 vom 2026-05-07",
        "url": "https://errata.build.resf.org/RLSA-2026:12285"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:15892 vom 2026-05-11",
        "url": "https://access.redhat.com/errata/RHSA-2026:15892"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2026-15892 vom 2026-05-11",
        "url": "https://linux.oracle.com/errata/ELSA-2026-15892.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17689 vom 2026-05-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:17689"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17688 vom 2026-05-15",
        "url": "https://access.redhat.com/errata/RHSA-2026:17688"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17687 vom 2026-05-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:17687"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17477 vom 2026-05-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:17477"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:15892 vom 2026-05-13",
        "url": "https://errata.build.resf.org/RLSA-2026:15892"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17690 vom 2026-05-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:17690"
      },
      {
        "category": "external",
        "summary": "PoC CVE-2026-33626 vom 2026-05-14",
        "url": "https://github.com/rootdirective-sec/CVE-2026-33626-Lab"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19466 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19466"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19041 vom 2026-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:19041"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19201 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19201"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19131 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19131"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19461 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19461"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19462 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19462"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19465 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19465"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19467 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19467"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2026:19201 vom 2026-05-20",
        "url": "https://errata.build.resf.org/RLSA-2026:19201"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19348 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19348"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19464 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19464"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19468 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19468"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19542 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19542"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19469 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19469"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19463 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19463"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19655 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19655"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19704 vom 2026-05-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:19704"
      }
    ],
    "source_lang": "en-US",
    "title": "Mozilla Thunderbird, Firefox ESR und Firefox: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-20T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-21T07:57:26.231+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1228",
      "initial_release_date": "2026-04-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-04-22T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2026-04-23T22:00:00.000+00:00",
          "number": "3",
          "summary": "Anpassung CVSS Bewertung gem\u00e4\u00df NVD Angaben"
        },
        {
          "date": "2026-04-26T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von openSUSE und Debian aufgenommen"
        },
        {
          "date": "2026-04-27T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Oracle Linux, Red Hat und openSUSE aufgenommen"
        },
        {
          "date": "2026-04-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation und SUSE aufgenommen"
        },
        {
          "date": "2026-05-03T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Oracle Linux, Rocky Enterprise Software Foundation und Red Hat aufgenommen"
        },
        {
          "date": "2026-05-04T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat und openSUSE aufgenommen"
        },
        {
          "date": "2026-05-05T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2026-05-06T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-05-07T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-05-10T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-11T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2026-05-14T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat und Rocky Enterprise Software Foundation, sowie PoC f\u00fcr CVE-2026-33626 aufgenommen"
        },
        {
          "date": "2026-05-19T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2026-05-20T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "16"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c150",
                "product": {
                  "name": "Mozilla Firefox \u003c150",
                  "product_id": "T053198"
                }
              },
              {
                "category": "product_version",
                "name": "150",
                "product": {
                  "name": "Mozilla Firefox 150",
                  "product_id": "T053198-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:firefox:150"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Firefox"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c140.10",
                "product": {
                  "name": "Mozilla Firefox ESR \u003c140.10",
                  "product_id": "T053196"
                }
              },
              {
                "category": "product_version",
                "name": "140.1",
                "product": {
                  "name": "Mozilla Firefox ESR 140.10",
                  "product_id": "T053196-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:firefox_esr:140.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c115.35",
                "product": {
                  "name": "Mozilla Firefox ESR \u003c115.35",
                  "product_id": "T053197"
                }
              },
              {
                "category": "product_version",
                "name": "115.35",
                "product": {
                  "name": "Mozilla Firefox ESR 115.35",
                  "product_id": "T053197-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:firefox_esr:115.35"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Firefox ESR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c140.10",
                "product": {
                  "name": "Mozilla Thunderbird \u003c140.10",
                  "product_id": "T053194"
                }
              },
              {
                "category": "product_version",
                "name": "140.1",
                "product": {
                  "name": "Mozilla Thunderbird 140.10",
                  "product_id": "T053194-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:thunderbird:140.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c150",
                "product": {
                  "name": "Mozilla Thunderbird \u003c150",
                  "product_id": "T053195"
                }
              },
              {
                "category": "product_version",
                "name": "150",
                "product": {
                  "name": "Mozilla Thunderbird 150",
                  "product_id": "T053195-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mozilla:thunderbird:150"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Thunderbird"
          }
        ],
        "category": "vendor",
        "name": "Mozilla"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RESF Rocky Linux",
                "product": {
                  "name": "RESF Rocky Linux",
                  "product_id": "T032255",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:resf:rocky_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9",
                "product": {
                  "name": "RESF Rocky Linux 9",
                  "product_id": "T054059",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:resf:rocky_linux:9"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rocky Linux"
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.8",
                "product": {
                  "name": "Red Hat Enterprise Linux 8.8",
                  "product_id": "T054056",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-2781",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-2781"
    },
    {
      "cve": "CVE-2026-33626",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-33626"
    },
    {
      "cve": "CVE-2026-6746",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6746"
    },
    {
      "cve": "CVE-2026-6747",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6747"
    },
    {
      "cve": "CVE-2026-6748",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6748"
    },
    {
      "cve": "CVE-2026-6749",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6749"
    },
    {
      "cve": "CVE-2026-6750",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6750"
    },
    {
      "cve": "CVE-2026-6751",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6751"
    },
    {
      "cve": "CVE-2026-6752",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6752"
    },
    {
      "cve": "CVE-2026-6753",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6753"
    },
    {
      "cve": "CVE-2026-6754",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6754"
    },
    {
      "cve": "CVE-2026-6755",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6755"
    },
    {
      "cve": "CVE-2026-6756",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6756"
    },
    {
      "cve": "CVE-2026-6757",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6757"
    },
    {
      "cve": "CVE-2026-6758",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6758"
    },
    {
      "cve": "CVE-2026-6759",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6759"
    },
    {
      "cve": "CVE-2026-6760",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6760"
    },
    {
      "cve": "CVE-2026-6761",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6761"
    },
    {
      "cve": "CVE-2026-6762",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6762"
    },
    {
      "cve": "CVE-2026-6763",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6763"
    },
    {
      "cve": "CVE-2026-6764",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6764"
    },
    {
      "cve": "CVE-2026-6765",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6765"
    },
    {
      "cve": "CVE-2026-6766",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6766"
    },
    {
      "cve": "CVE-2026-6767",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6767"
    },
    {
      "cve": "CVE-2026-6768",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6768"
    },
    {
      "cve": "CVE-2026-6769",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6769"
    },
    {
      "cve": "CVE-2026-6770",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6770"
    },
    {
      "cve": "CVE-2026-6771",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6771"
    },
    {
      "cve": "CVE-2026-6772",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6772"
    },
    {
      "cve": "CVE-2026-6773",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6773"
    },
    {
      "cve": "CVE-2026-6774",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6774"
    },
    {
      "cve": "CVE-2026-6775",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6775"
    },
    {
      "cve": "CVE-2026-6776",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6776"
    },
    {
      "cve": "CVE-2026-6777",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6777"
    },
    {
      "cve": "CVE-2026-6778",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6778"
    },
    {
      "cve": "CVE-2026-6779",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6779"
    },
    {
      "cve": "CVE-2026-6780",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6780"
    },
    {
      "cve": "CVE-2026-6781",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6781"
    },
    {
      "cve": "CVE-2026-6782",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6782"
    },
    {
      "cve": "CVE-2026-6783",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6783"
    },
    {
      "cve": "CVE-2026-6784",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6784"
    },
    {
      "cve": "CVE-2026-6785",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6785"
    },
    {
      "cve": "CVE-2026-6786",
      "product_status": {
        "known_affected": [
          "T053198",
          "T054056",
          "T053196",
          "T053197",
          "T053194",
          "67646",
          "T053195",
          "T004914",
          "T032255",
          "T054059",
          "2951",
          "T002207",
          "T027843"
        ]
      },
      "release_date": "2026-04-21T22:00:00.000+00:00",
      "title": "CVE-2026-6786"
    }
  ]
}

CVE-2026-2781 (GCVE-0-2026-2781)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-21 12:40

Title

Integer overflow in the Libraries component in NSS

Summary

Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2009552
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.35 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Clay Ver Valen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:07:29.760093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T20:07:34.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-25T16:26:01.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.35",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Clay Ver Valen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35."
            }
          ],
          "value": "Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T12:40:43.312Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2009552"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-31/"
        }
      ],
      "title": "Integer overflow in the Libraries component in NSS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2781",
    "datePublished": "2026-02-24T13:33:15.551Z",
    "dateReserved": "2026-02-19T15:06:13.592Z",
    "dateUpdated": "2026-04-21T12:40:43.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33626 (GCVE-0-2026-33626)

Vulnerability from cvelistv5 – Published: 2026-04-20 20:29 – Updated: 2026-04-21 19:50

Title

LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Summary

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/InternLM/lmdeploy/security/adv…	x_refsource_CONFIRM
https://github.com/InternLM/lmdeploy/pull/4447	x_refsource_MISC
https://github.com/InternLM/lmdeploy/commit/71d64…	x_refsource_MISC
https://github.com/InternLM/lmdeploy/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
InternLM	lmdeploy	Affected: < 0.12.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33626",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T17:52:10.383689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T19:50:13.326Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lmdeploy",
          "vendor": "InternLM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.12.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy\u0027s vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-20T20:29:19.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq"
        },
        {
          "name": "https://github.com/InternLM/lmdeploy/pull/4447",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternLM/lmdeploy/pull/4447"
        },
        {
          "name": "https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626"
        },
        {
          "name": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3"
        }
      ],
      "source": {
        "advisory": "GHSA-6w67-hwm5-92mq",
        "discovery": "UNKNOWN"
      },
      "title": "LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33626",
    "datePublished": "2026-04-20T20:29:19.558Z",
    "dateReserved": "2026-03-23T14:24:11.617Z",
    "dateUpdated": "2026-04-21T19:50:13.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6746 (GCVE-0-2026-6746)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-22 15:08

Title

Use-after-free in the DOM: Core & HTML component

Summary

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2014596
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.35 , ≤ 115.* (rpm) Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T15:08:29.668813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T15:08:34.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.35",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:37.002Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014596"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-31/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Use-after-free in the DOM: Core \u0026 HTML component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6746",
    "datePublished": "2026-04-21T12:40:44.148Z",
    "dateReserved": "2026-04-21T12:40:43.779Z",
    "dateUpdated": "2026-04-22T15:08:34.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6747 (GCVE-0-2026-6747)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-22 15:08

Title

Use-after-free in the WebRTC component

Summary

Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2021769
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

Nan Wang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6747",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T15:08:07.894531Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T15:08:13.152Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Nan Wang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:38.193Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2021769"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Use-after-free in the WebRTC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6747",
    "datePublished": "2026-04-21T12:40:45.203Z",
    "dateReserved": "2026-04-21T12:40:44.581Z",
    "dateUpdated": "2026-04-22T15:08:13.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6748 (GCVE-0-2026-6748)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-21 23:34

Title

Uninitialized memory in the Audio/Video: Web Codecs component

Summary

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2022604
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

Inseo An

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T18:38:50.092884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-457",
                "description": "CWE-457 Use of Uninitialized Variable",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T18:39:29.079Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Inseo An"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:39.302Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2022604"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Uninitialized memory in the Audio/Video: Web Codecs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6748",
    "datePublished": "2026-04-21T12:40:45.923Z",
    "dateReserved": "2026-04-21T12:40:45.603Z",
    "dateUpdated": "2026-04-21T23:34:39.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6749 (GCVE-0-2026-6749)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-22 15:07

Title

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component

Summary

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2022610
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.35 , ≤ 115.* (rpm) Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

Inseo An

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6749",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T15:07:48.753319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T15:07:52.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.35",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Inseo An"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:40.339Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2022610"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-31/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Information disclosure due to uninitialized memory in the Graphics: Canvas2D component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6749",
    "datePublished": "2026-04-21T12:40:46.800Z",
    "dateReserved": "2026-04-21T12:40:46.464Z",
    "dateUpdated": "2026-04-22T15:07:52.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6750 (GCVE-0-2026-6750)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-24 13:44

Title

Privilege escalation in the Graphics: WebRender component

Summary

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2023407
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.35 , ≤ 115.* (rpm) Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

choeseyeong

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6750",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T03:56:00.618420Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T13:44:25.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.35",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "choeseyeong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:41.650Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2023407"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-31/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Privilege escalation in the Graphics: WebRender component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6750",
    "datePublished": "2026-04-21T12:40:47.476Z",
    "dateReserved": "2026-04-21T12:40:47.165Z",
    "dateUpdated": "2026-04-24T13:44:25.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6751 (GCVE-0-2026-6751)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-21 23:34

Title

Uninitialized memory in the Audio/Video: Web Codecs component

Summary

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2025883
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

Joren Afman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T18:58:34.332123Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-457",
                "description": "CWE-457 Use of Uninitialized Variable",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T18:58:57.301Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Joren Afman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:42.935Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2025883"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Uninitialized memory in the Audio/Video: Web Codecs component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6751",
    "datePublished": "2026-04-21T12:40:48.315Z",
    "dateReserved": "2026-04-21T12:40:47.871Z",
    "dateUpdated": "2026-04-21T23:34:42.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6752 (GCVE-0-2026-6752)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-21 23:34

Title

Incorrect boundary conditions in the WebRTC component

Summary

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2027499
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.35 , ≤ 115.* (rpm) Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

jmwebdevelopement

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T19:01:52.321484Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T19:01:55.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.35",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "jmwebdevelopement"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:44.029Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2027499"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-31/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Incorrect boundary conditions in the WebRTC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6752",
    "datePublished": "2026-04-21T12:40:49.079Z",
    "dateReserved": "2026-04-21T12:40:48.727Z",
    "dateUpdated": "2026-04-21T23:34:44.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6753 (GCVE-0-2026-6753)

Vulnerability from cvelistv5 – Published: 2026-04-21 12:40 – Updated: 2026-04-22 15:35

Title

Incorrect boundary conditions in the WebRTC component

Summary

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Severity ?

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2027501
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.10 , ≤ 140.* (rpm) Unaffected: 150 , ≤ * (rpm)

Credits

jmwebdevelopement

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-6753",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T14:17:54.884144Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T15:35:18.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.10",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "150",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "jmwebdevelopement"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
            }
          ],
          "value": "Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T23:34:45.288Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2027501"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-30/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-32/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-33/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-34/"
        }
      ],
      "title": "Incorrect boundary conditions in the WebRTC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-6753",
    "datePublished": "2026-04-21T12:40:49.893Z",
    "dateReserved": "2026-04-21T12:40:49.549Z",
    "dateUpdated": "2026-04-22T15:35:18.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-1228

CVE-2026-2781 (GCVE-0-2026-2781)

CVE-2026-33626 (GCVE-0-2026-33626)

CVE-2026-6746 (GCVE-0-2026-6746)

CVE-2026-6747 (GCVE-0-2026-6747)

CVE-2026-6748 (GCVE-0-2026-6748)

CVE-2026-6749 (GCVE-0-2026-6749)

CVE-2026-6750 (GCVE-0-2026-6750)

CVE-2026-6751 (GCVE-0-2026-6751)

CVE-2026-6752 (GCVE-0-2026-6752)

CVE-2026-6753 (GCVE-0-2026-6753)

Tags

Sightings

Nomenclature