Mozilla
Number 11 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
2,565
Critical
340
High
748
Known Exploited
13
Exploit available
12
Network, no login needed
95.3%
Of 1,604 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 969 | 227 | 481 | 220 | 0 | 41 |
| 2025 | 208 | 47 | 77 | 80 | 4 | 0 |
| 2024 | 202 | 34 | 75 | 90 | 3 | 0 |
| 2023 | 194 | 12 | 33 | 32 | 0 | 117 |
| 2022 | 177 | 18 | 73 | 83 | 1 | 2 |
| 2021 | 147 | 0 | 1 | 0 | 0 | 146 |
| 2020 | 175 | 0 | 4 | 1 | 0 | 170 |
| 2019 | 139 | 1 | 1 | 0 | 0 | 137 |
| 2018 | 348 | 0 | 1 | 1 | 0 | 346 |
| 2017 | 2 | 0 | 0 | 0 | 0 | 2 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2015 | 1 | 0 | 1 | 0 | 0 | 0 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2013 | 2 | 0 | 1 | 1 | 0 | 0 |
| 2012 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2010 | 1 | 1 | 0 | 0 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Firefox | 1,956 | 967 |
| Thunderbird | 324 | 65 |
| Firefox ESR | 154 | 22 |
| Firefox for iOS | 63 | 14 |
| Firefox for Android | 13 | 4 |
| Focus for iOS | 12 | 4 |
| Thunderbird ESR | 7 | 0 |
| NSS | 5 | 0 |
| Hubs Cloud | 2 | 0 |
| Mozilla Bleach | 2 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 688 | 564 |
| Information Disclosure | 76 | 37 |
| Protection Mechanism Failure | 69 | 61 |
| Origin Validation Error | 52 | 32 |
| Privilege Escalation | 52 | 51 |
| User Interface (UI) Misrepresentation of Critical Information | 45 | 12 |
| Cross-Site Scripting | 41 | 9 |
| Improper Restriction of Rendered UI Layers or Frames | 34 | 9 |
| Race Condition | 31 | 16 |
| Denial of Service | 29 | 17 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2024-9680 | Mozilla Firefox: Memory Corruption | Critical | 23.2% | |
| CVE-2022-26486 | Mozilla Firefox: Memory Corruption | Critical | 2.4% | |
| CVE-2022-26485 | Mozilla Firefox: Memory Corruption | High | 14.3% | |
| CVE-2020-6820 | Mozilla Thunderbird: Race Condition | High | 7.1% | |
| CVE-2020-6819 | Mozilla Thunderbird: Memory Corruption | High | 3.0% | |
| CVE-2019-17026 | Mozilla Firefox ESR: Type Confusion | High | 46.3% | |
| CVE-2019-11708 | Mozilla Firefox ESR: Improper Input Validation | Critical | 55.9% | |
| CVE-2019-11707 | Mozilla Firefox ESR: Type Confusion | High | 38.0% | |
| CVE-2016-9079 | Mozilla Firefox: Memory Corruption | High | 87.4% | |
| CVE-2015-4495 | Mozilla Firefox Security Feature Bypass Vulnerability | High | 68.6% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-126136 | OAuth2 access token could be sent over an unencrypted connection with Exchange accounts | None | n/a | |
| CVE-2026-126135 | SMTP and POP3 response injection when using STARTTLS | None | n/a | |
| CVE-2026-126134 | Feed subscriptions could leak NTLM credentials on Windows | None | n/a | |
| CVE-2026-126133 | Calendar server credentials could be sent to an HTTP proxy | None | n/a | |
| CVE-2026-126132 | Attachments could be replaced with local file content when forwarding | None | n/a | |
| CVE-2026-124952 | Use-after-free in the Audio/Video component | High | n/a | |
| CVE-2026-124951 | Privilege escalation in the Nimbus Desktop Client component | None | n/a | |
| CVE-2026-124950 | Same-origin policy bypass in the CSS Parsing and Computation component | None | n/a | |
| CVE-2026-124949 | Other issue in the SVG component | None | n/a | |
| CVE-2026-124948 | Incorrect boundary conditions, use-after-free in the Graphics component | High | n/a |