The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6394 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6394-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 22, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2026-15718 CVE-2026-15719 CVE-2026-16349 CVE-2026-16350                      CVE-2026-16351 CVE-2026-16352 CVE-2026-16353 CVE-2026-16354                      CVE-2026-16355 CVE-2026-16356 CVE-2026-16357 CVE-2026-16358                      CVE-2026-16359 CVE-2026-16360 CVE-2026-16361 CVE-2026-16362                      CVE-2026-16363 CVE-2026-16368 CVE-2026-16369 CVE-2026-16371                      CVE-2026-16374 CVE-2026-16375 CVE-2026-16377 CVE-2026-16379                      CVE-2026-16381 CVE-2026-16383 CVE-2026-16387 CVE-2026-16390                      CVE-2026-16391 CVE-2026-16396 CVE-2026-16405 CVE-2026-16412

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code, bypass of the same-origin policy, privilege escalation,     information disclosure, spoofing or sandbox escape.

    For the stable distribution (trixie), these problems have been fixed in     version 140.13.0esr-1~deb13u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-47101 advisory.

    [140.13.0-1.0.1]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]
    - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

    [140.13.0-1]
    - Update to 140.13.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0788 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-16412:
    Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

    CVE-2026-16405:
    Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox     153 and Firefox ESR 140.13.

    CVE-2026-16396:
    Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

    CVE-2026-16391:
    Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153     and Firefox ESR 140.13.

    CVE-2026-16390:
    Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153 and     Firefox ESR 140.13.

    CVE-2026-16387:
    Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153 and Firefox     ESR 140.13.

    CVE-2026-16383:
    Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and     Firefox ESR 140.13.

    CVE-2026-16381:
    Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153     and Firefox ESR 140.13.

    CVE-2026-16379:
    Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153     and Firefox ESR 140.13.

    CVE-2026-16377:
    Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153 and Firefox ESR     140.13.

    CVE-2026-16375:
    Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153 and     Firefox ESR 140.13.

    CVE-2026-16374:
    Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153     and Firefox ESR 140.13.

    CVE-2026-16371:
    Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and     Firefox ESR 140.13.

    CVE-2026-16369:
    Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153 and     Firefox ESR 140.13.

    CVE-2026-16368:
    Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in     Firefox 153 and Firefox ESR 140.13.

    CVE-2026-16363:
    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153     and Firefox ESR 140.13.

    CVE-2026-16362:
    Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153 and     Firefox ESR 140.13.

    CVE-2026-16361:
    Memory safety bugs present in Firefox ESR 115.37 and Firefox ESR 140.12. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38 and Firefox ESR     140.13.

    CVE-2026-16360:
    Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and     Firefox ESR 140.13.

    CVE-2026-16359:
    Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16358:
    Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16357:
    Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16356:
    Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed     in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16355:
    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16354:
    Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16353:
    Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16352:
    Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed     in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16351:
    Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in     Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16350:
    Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-16349:
    Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, and Firefox ESR 140.13.

    CVE-2026-15719:
    We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.

    CVE-2026-15718:
    We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53475 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53444 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3546-1 advisory.

    Update to Mozilla Thunderbird 140.13.
    - MFSA 2026-72 (bsc#1271649)
      * CVE-2026-14899: Off-by-one out of bounds read in MIME header parser for forwarding
      * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
      * CVE-2026-15719: Site isolation issue in the DOM: Navigation component
      * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
      * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
      * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
      * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component
      * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component
      * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component
      * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component
      * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component
      * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component
      * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component
      * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component
      * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component
      * CVE-2026-16357: Incorrect boundary conditions in the Graphics component
      * CVE-2026-16371: Privilege escalation in the DOM: Navigation component
      * CVE-2026-16374: Information disclosure in the Framework component in DevTools
      * CVE-2026-16375: Site isolation issue in the Networking: HTTP component
      * CVE-2026-16377: Mitigation bypass in the PDF Viewer component
      * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component
      * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component
      * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component
      * CVE-2026-16383: Mitigation bypass in the DOM: Networking component
      * CVE-2026-16387: Site isolation issue in the Networking component
      * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
      * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component
      * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component
      * CVE-2026-16396: Privilege escalation in WebExtensions
      * CVE-2026-16405: Information disclosure in the Networking: WebSockets component
      * CVE-2026-16412: Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
      * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
      * CVE-2026-16361: Memory safety bugs fixed in Thunderbird ESR 140.13

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1547:18 advisory.

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
      * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
      * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component     (CVE-2026-16350)
      * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
      * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)
      * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
      * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
      * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)
      * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)
      * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox     153 (CVE-2026-16360)
      * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
      * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
      * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
      * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
      * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)
      * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
      * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
      * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
      * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
      * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
      * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
      * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
      * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
      * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
      * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1625:19 advisory.

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
      * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
      * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component     (CVE-2026-16350)
      * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
      * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)
      * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
      * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
      * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)
      * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)
      * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox     153 (CVE-2026-16360)
      * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
      * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
      * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
      * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
      * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)
      * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
      * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
      * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
      * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
      * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
      * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
      * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
      * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
      * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
      * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-47105 advisory.

    [140.13.0-1.0.1]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789]
    - diable wasi_sdk to prevent build failure with newer llvm

    [140.13.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [140.13.0-1]
    - Update to 140.13.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:47105 advisory.

    * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode     (CVE-2026-56208)
      * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
      * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
      * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component     (CVE-2026-16350)
      * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
      * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)
      * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
      * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
      * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)
      * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)
      * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox     153 (CVE-2026-16360)
      * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
      * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
      * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
      * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
      * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)
      * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
      * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
      * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
      * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
      * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
      * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
      * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
      * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
      * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1698:20 advisory.

    * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode     (CVE-2026-56208)
      * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
      * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
      * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component     (CVE-2026-16350)
      * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
      * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)
      * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
      * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
      * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)
      * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)
      * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox     153 (CVE-2026-16360)
      * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
      * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
      * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
      * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
      * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)
      * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
      * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
      * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
      * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
      * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
      * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
      * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
      * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
      * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-54248 advisory.

    - Update to 140.13.0 ESR [Orabug: 39947841][CVE-2026-15718][CVE-2026-15719]       [CVE-2026-16349][CVE-2026-16350][CVE-2026-16351][CVE-2026-16352][CVE-2026-16353]       [CVE-2026-16354][CVE-2026-16355][CVE-2026-16356][CVE-2026-16357][CVE-2026-16358]       [CVE-2026-16359][CVE-2026-16360][CVE-2026-16361][CVE-2026-16362][CVE-2026-16363]       [CVE-2026-16368][CVE-2026-16369][CVE-2026-16371][CVE-2026-16374][CVE-2026-16375]       [CVE-2026-16377][CVE-2026-16379][CVE-2026-16381][CVE-2026-16383][CVE-2026-16387]       [CVE-2026-16390][CVE-2026-16391][CVE-2026-16396][CVE-2026-16405][CVE-2026-16412]       [CVE-2026-56208]
    - Update to 140.10.2 ESR [Orabug: 39534787][CVE-2026-8090][CVE-2026-8092]       [CVE-2026-8094]
    - Update to 140.10.1 ESR [Orabug: 39481850][CVE-2026-7320][CVE-2026-7321]       [CVE-2026-7322][CVE-2026-7323]
    - Update to 140.10.0 ESR [Orabug: 39499844][CVE-2026-6746][CVE-2026-6747]       [CVE-2026-6748][CVE-2026-6749][CVE-2026-6750][CVE-2026-6751][CVE-2026-6752]       [CVE-2026-6753][CVE-2026-6754][CVE-2026-6757][CVE-2026-6759][CVE-2026-6761]       [CVE-2026-6762][CVE-2026-6763][CVE-2026-6764][CVE-2026-6765][CVE-2026-6766]       [CVE-2026-6767][CVE-2026-6769][CVE-2026-6770][CVE-2026-6771][CVE-2026-6772]       [CVE-2026-6776][CVE-2026-6785][CVE-2026-6786]
    - Update to 140.9.1 ESR [Orabug: 39324689][CVE-2026-5731][CVE-2026-5732]       [CVE-2026-5734][CVE-2026-33416][CVE-2026-33636]
    - Update to 140.9.0 ESR [Orabug: 39361657][CVE-2026-4684][CVE-2026-4685]       [CVE-2026-4686][CVE-2026-4687][CVE-2026-4688][CVE-2026-4689][CVE-2026-4690]       [CVE-2026-4691][CVE-2026-4692][CVE-2026-4693][CVE-2026-4694][CVE-2026-4695]       [CVE-2026-4696][CVE-2026-4697][CVE-2026-4698][CVE-2026-4699][CVE-2026-4700]       [CVE-2026-4701][CVE-2026-4702][CVE-2026-4704][CVE-2026-4705][CVE-2026-4706]       [CVE-2026-4707][CVE-2026-4708][CVE-2026-4709][CVE-2026-4710][CVE-2026-4711]       [CVE-2026-4712][CVE-2026-4713][CVE-2026-4714][CVE-2026-4715][CVE-2026-4716]       [CVE-2026-4717][CVE-2026-4718][CVE-2026-4719][CVE-2026-4720][CVE-2026-4721]
    - Update to 140.8.0 ESR [Orabug: 39361647][CVE-2026-2447][CVE-2026-2757]       [CVE-2026-2758][CVE-2026-2759][CVE-2026-2760][CVE-2026-2761][CVE-2026-2762]       [CVE-2026-2763][CVE-2026-2764][CVE-2026-2765][CVE-2026-2766][CVE-2026-2767]       [CVE-2026-2768][CVE-2026-2769][CVE-2026-2770][CVE-2026-2771][CVE-2026-2772]       [CVE-2026-2773][CVE-2026-2774][CVE-2026-2775][CVE-2026-2776][CVE-2026-2777]       [CVE-2026-2778][CVE-2026-2779][CVE-2026-2780][CVE-2026-2781][CVE-2026-2782]       [CVE-2026-2783][CVE-2026-2784][CVE-2026-2785][CVE-2026-2786][CVE-2026-2787]       [CVE-2026-2788][CVE-2026-2789][CVE-2026-2790][CVE-2026-2791][CVE-2026-2792]       [CVE-2026-2793]
    - Update to 140.7.0 ESR [Orabug: 38940976][CVE-2025-14327][CVE-2026-0877]       [CVE-2026-0878][CVE-2026-0879][CVE-2026-0880][CVE-2026-0882][CVE-2026-0883]       [CVE-2026-0884][CVE-2026-0885][CVE-2026-0886][CVE-2026-0887][CVE-2026-0890]       [CVE-2026-0891]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
329076	Debian dsa-6394 : firefox-esr - security update	Nessus	Debian Local Security Checks	2026/7/22	2026/7/27	critical
331916	Oracle Linux 10 : firefox (ELSA-2026-47101)	Nessus	Oracle Linux Local Security Checks	2026/8/4	2026/8/4	critical
333134	TencentOS Server 4: firefox (TSSA-2026:0788)	Nessus	Tencent Local Security Checks	2026/8/6	2026/8/6	critical
334543	RHEL 9 : thunderbird (RHSA-2026:53475)	Nessus	Red Hat Local Security Checks	2026/8/11	2026/8/11	critical
334545	RHEL 9 : thunderbird (RHSA-2026:53444)	Nessus	Red Hat Local Security Checks	2026/8/11	2026/8/11	critical
334713	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2026:3546-1)	Nessus	SuSE Local Security Checks	2026/8/12	2026/8/12	critical
335932	MiracleLinux 8 : thunderbird-140.13.0-1.el8_10.ML.1 (AXSA:2026-1547:18)	Nessus	Miracle Linux Local Security Checks	2026/8/17	2026/8/18	critical
339057	MiracleLinux 9 : thunderbird-140.13.0-1.el9_8.ML.1 (AXSA:2026-1625:19)	Nessus	Miracle Linux Local Security Checks	2026/8/24	2026/8/24	critical
330615	Oracle Linux 8 : firefox (ELSA-2026-47105)	Nessus	Oracle Linux Local Security Checks	2026/7/29	2026/7/29	critical
333348	AlmaLinux 8 : firefox (ALSA-2026:47105)	Nessus	Alma Linux Local Security Checks	2026/8/7	2026/8/7	critical
341611	MiracleLinux 9 : firefox-140.13.0-1.el9_8.ML.1 (AXSA:2026-1698:20)	Nessus	Miracle Linux Local Security Checks	2026/8/30	2026/9/1	critical
348777	Oracle Linux 7 : firefox (ELSA-2026-54248)	Nessus	Oracle Linux Local Security Checks	2026/9/22	2026/9/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical