Mozilla Mozilla Firefox ESR <153.2

Name: Mozilla Mozilla Firefox ESR <153.2
Brand: Mozilla

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

unpatched

by severity

5critical0high4medium0low

updated 2026-10-27

vulnerabilities (38)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-84118US	—	0.29% (21st)	Exploit	153.2	2026-09-01	< 153.2
CVE-2026-84637US	—	0.63% (50th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84134US	—	0.57% (47th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84142US	critical9.8	0.56% (46th)	—	153.2	2026-09-01	< 153.2
CVE-2026-75874US	—	0.46% (39th)	—	153.2	2026-08-18	< 153.2
CVE-2026-84135US	critical9.8	0.45% (39th)	—	153.2	2026-09-01	< 153.2
CVE-2026-16371US	—	0.44% (38th)	—	153.2	2026-07-21	< 153.2
CVE-2026-84130US	—	0.44% (38th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84128US	—	0.44% (38th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84123US	—	0.44% (38th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84144US	—	0.43% (37th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84642US	—	0.42% (36th)	—	153.2	2026-09-01	< 153.2
CVE-2026-74952US	—	0.41% (36th)	—	153.2	2026-08-18	< 153.2
CVE-2026-84143US	critical9.8	0.38% (32nd)	—	153.2	2026-09-01	< 153.2
CVE-2026-84138US	medium6.5	0.37% (31st)	—	153.2	2026-09-01	< 153.2
CVE-2026-84145US	—	0.37% (31st)	—	153.2	2026-09-01	< 153.2
CVE-2026-84117US	—	0.35% (28th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84141US	critical9.8	0.34% (28th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84139US	medium6.1	0.34% (27th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84131US	—	0.33% (26th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84639US	—	0.32% (25th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84121US	—	0.32% (25th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84119US	—	0.32% (25th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84126US	—	0.31% (24th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84125US	—	0.29% (21st)	—	153.2	2026-09-01	< 153.2
CVE-2026-16365US	—	0.28% (20th)	—	153.2	2026-07-21	< 153.2
CVE-2026-84641US	—	0.27% (19th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84640US	—	0.26% (18th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84127US	—	0.26% (17th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84132US	—	0.26% (17th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84120US	—	0.22% (12th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84122US	—	0.21% (12th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84136US	medium6.1	0.20% (10th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84133US	—	0.18% (8th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84129US	—	0.18% (8th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84140US	critical9.8	0.18% (8th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84124US	—	0.17% (6th)	—	153.2	2026-09-01	< 153.2
CVE-2026-84137US	medium4.3	0.13% (2nd)	—	153.2	2026-09-01	< 153.2

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-416Use After Free9 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor8 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer4 CVEs
CWE-346Origin Validation Error4 CVEs
CWE-269Improper Privilege Management3 CVEs
CWE-284Improper Access Control3 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames1 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')1 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)38 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan