Mozilla Firefox ESR

Name: Mozilla Firefox ESR
Brand: Mozilla

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

249critical334high285medium4low

updated 2026-10-27

vulnerabilities (1,643)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2016-9079US	high7.5OT critical	87.4% (100th)	KEV	45.5.1	2018-06-11	unspecified → 45.5.1
CVE-2020-15999US	critical9.6OT critical	63.9% (99th)	KEV	78.5	2020-11-03	< 78.5
CVE-2019-11708US	critical10.0OT critical	55.9% (99th)	KEV	60.7.2	2019-07-23	unspecified → 60.7.2
CVE-2019-17026US	high8.8OT critical	46.3% (99th)	KEV	68.4.1	2020-03-02	unspecified → 68.4.1
CVE-2019-11707US	high8.8OT critical	37.7% (99th)	KEV	60.7.1	2019-07-23	unspecified → 60.7.1
CVE-2024-9680US	critical9.8OT critical	23.2% (98th)	KEV	115.16.1	2024-10-09	4 versions
CVE-2022-26485US	high8.8OT critical	14.3% (97th)	KEV	91.6.1	2022-12-22	unspecified → 91.6.1
CVE-2020-6820US	high8.1OT critical	7.06% (94th)	KEV	68.6.1	2020-04-24	unspecified → 68.6.1
CVE-2020-6819US	high8.1OT critical	3.04% (87th)	KEV	68.6.1	2020-04-24	unspecified → 68.6.1
CVE-2022-26486US	critical9.6OT critical	2.36% (84th)	KEV	91.6.1	2022-12-22	unspecified → 91.6.1
CVE-2024-4367US	high8.8	70.7% (99th)	Exploit	115.11	2024-05-14	unspecified → 115.11
CVE-2026-33626US	—	45.3% (99th)	Exploit	140.10	2026-04-20	2 versions
CVE-2020-26950US	high8.8	42.3% (99th)	Exploit	no fix	2020-12-09	≤ < 78.4.1
CVE-2017-5375US	critical9.8	34.1% (98th)	Exploit	45.7	2018-06-11	unspecified → 45.7
CVE-2022-1802US	high8.8	28.5% (98th)	Exploit	91.9.1	2022-12-22	unspecified → 91.9.1
CVE-2019-9810US	high8.8	27.2% (98th)	Exploit	60.6.1	2019-04-26	unspecified → 60.6.1
CVE-2024-29943US	—	22.9% (98th)	Exploit	115.9.1	2024-03-22	< 115.9.1
CVE-2016-9899US	critical9.8	20.8% (98th)	Exploit	45.6	2018-06-11	unspecified → 45.6
CVE-2018-5159US	critical9.8	20.6% (98th)	Exploit	52.8	2018-06-11	unspecified → 52.8
CVE-2019-9791US	critical9.8	19.9% (97th)	Exploit	60.6	2019-04-26	unspecified → 60.6
CVE-2017-5465US	critical9.1	18.2% (97th)	Exploit	52.1	2018-06-11	2 versions
CVE-2017-5447US	critical9.1	17.0% (97th)	Exploit	45.9	2018-06-11	2 versions
CVE-2017-5404US	critical9.8	16.9% (97th)	Exploit	45.8	2018-06-11	unspecified → 45.8
CVE-2022-24713US	high7.5	14.5% (97th)	Exploit	91.8	2022-03-08	< 91.8
CVE-2017-7783US	high7.5	13.8% (96th)	Exploit	52.3	2018-06-11	< 52.3
CVE-2018-12386US	high8.1	13.4% (96th)	Exploit	60.2.2	2018-10-18	unspecified → 60.2.2
CVE-2019-9792US	critical9.8	13.2% (96th)	Exploit	60.6	2019-04-26	unspecified → 60.6
CVE-2016-9066US	high7.5	12.0% (96th)	Exploit	45.5	2018-06-11	unspecified → 45.5
CVE-2018-5146US	high8.8	11.9% (96th)	Exploit	52.7.2	2018-06-11	unspecified → 52.7.2
CVE-2018-5158US	high8.8	10.2% (96th)	Exploit	52.8	2018-06-11	unspecified → 52.8
CVE-2019-9813US	high8.8	6.69% (94th)	Exploit	60.6.1	2019-04-26	unspecified → 60.6.1
CVE-2019-9816US	medium5.9	6.15% (93rd)	Exploit	60.7	2019-07-23	unspecified → 60.7
CVE-2024-8381US	critical9.8	4.40% (91st)	Exploit	115.15	2024-09-03	4 versions
CVE-2026-6770US	—	3.88% (90th)	Exploit	115.35	2026-04-21	2 versions
CVE-2022-28281US	high8.8	2.78% (86th)	Exploit	91.8	2022-12-22	2 versions
CVE-2020-16012US	medium4.3	2.57% (85th)	Exploit	78.5	2021-01-08	< 78.5
CVE-2024-0741US	medium6.5	2.15% (82nd)	Exploit	115.7	2024-01-23	3 versions
CVE-2025-1015US	medium5.4	1.37% (72nd)	Exploit	128.7	2025-02-04	2 versions
CVE-2026-2796US	critical9.8	0.95% (61st)	Exploit	115.33	2026-02-24	2 versions
CVE-2026-2766US	critical9.8	0.74% (54th)	Exploit	140.8	2026-02-24	2 versions
CVE-2026-2764US	critical9.8	0.74% (54th)	Exploit	115.33	2026-02-24	2 versions
CVE-2026-2763US	critical9.8	0.74% (54th)	Exploit	115.33	2026-02-24	2 versions
CVE-2026-74943US	critical9.8	0.61% (49th)	Exploit	153.1	2026-08-18	3 versions
CVE-2026-74936US	critical9.8	0.59% (48th)	Exploit	153.1	2026-08-18	3 versions
CVE-2026-4692US	critical10.0	0.51% (43rd)	Exploit	140.9	2026-03-24	2 versions
CVE-2026-74939US	—	0.45% (39th)	Exploit	153.1	2026-08-18	3 versions
CVE-2026-74945US	—	0.44% (38th)	Exploit	140.14	2026-08-18	3 versions
CVE-2026-12295US	—	0.39% (33rd)	Exploit	140.12	2026-06-16	2 versions
CVE-2026-15718US	—	0.32% (25th)	Exploit	115.38	2026-07-14	2 versions
CVE-2026-109715US	—	0.31% (24th)	Exploit	153.5	2026-10-13	2 versions

showing 50 of 1,643

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-416Use After Free314 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer274 CVEs
CWE-787Out-of-bounds Write163 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')137 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor116 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames82 CVEs
CWE-20Improper Input Validation71 CVEs
CWE-693Protection Mechanism Failure70 CVEs

sources (3)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)1,092 CVEs
EUEU Vulnerability Database (ENISA)714 CVEs
NLNCSC-NL (CSAF)48 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan