The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21380 advisory.

    * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

    * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

    * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

    * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

    * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151     (CVE-2026-8975)

    * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

    * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component     (CVE-2026-8968)

    * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

    * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component     (CVE-2026-8958)

    * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

    * firefox: Privilege escalation in the Security component (CVE-2026-8970)

    * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

    * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

    * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

    * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

    * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

    * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:22325 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

    * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

    * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

    * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

    * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151     (CVE-2026-8975)

    * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

    * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component     (CVE-2026-8968)

    * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

    * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component     (CVE-2026-8958)

    * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

    * firefox: Privilege escalation in the Security component (CVE-2026-8970)

    * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

    * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

    * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

    * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component     (CVE-2026-8959)

    * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

    * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

    * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:27715 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

    * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

    * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

    * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

    * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151     (CVE-2026-8975)

    * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

    * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component     (CVE-2026-8968)

    * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

    * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component     (CVE-2026-8958)

    * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

    * firefox: Privilege escalation in the Security component (CVE-2026-8970)

    * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

    * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

    * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

    * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

    * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

    * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:26491 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

    * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

    * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

    * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

    * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151     (CVE-2026-8975)

    * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

    * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component     (CVE-2026-8968)

    * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

    * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component     (CVE-2026-8958)

    * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

    * firefox: Privilege escalation in the Security component (CVE-2026-8970)

    * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

    * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

    * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

    * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

    * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

    * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101375 advisory.

    Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox     ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 151.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-46 advisory.

  - Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2026-8975)

  - Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox     ESR 140.11, Thunderbird 151, and Thunderbird 140.11. (CVE-2026-8956)

  - Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
    (CVE-2026-8945)

  - Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in     Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
    (CVE-2026-8946)

  - Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151,     Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. (CVE-2026-8947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 140.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-48 advisory.

  - Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2026-8975)

  - Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox     ESR 140.11, Thunderbird 151, and Thunderbird 140.11. (CVE-2026-8956)

  - Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in     Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
    (CVE-2026-8946)

  - Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in     Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. (CVE-2026-8388)

  - Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151,     Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. (CVE-2026-8947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-cd20332935 advisory.

    Update NSS to 3.123.1     Update to Firefox 151.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-21382 advisory.

    [140.11.0-1.0.1]
    - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789]
    - diable wasi_sdk to prevent build failure with newer llvm

    [140.11.0]
    - Add debranding patches (Mustafa Gezen)
    - Add OpenELA default preferences (Louis Abel)

    [140.11.0-1]
    - Update to 140.11.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:21380 advisory.

    * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)
      * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)
      * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)
      * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)
      * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151     (CVE-2026-8975)
      * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)
      * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component     (CVE-2026-8968)
      * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)
      * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component     (CVE-2026-8958)
      * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)
      * firefox: Privilege escalation in the Security component (CVE-2026-8970)
      * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)
      * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)
      * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)
      * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)
      * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)
      * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)
      * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20789-1 advisory.

    This update for MozillaFirefox fixes the following issues

    - Update to Firefox Extended Support Release 140.11.0 ESR MFSA 2026-48 (bsc#1265212).

    MFSA 2026-48:

    - CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component.
    - CVE-2026-8391: Other issue in the JavaScript Engine component.
    - CVE-2026-8401: Sandbox escape in the Profile Backup component.
    - CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component.
    - CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component.
    - CVE-2026-8949: Integer overflow in the Widget: Win32 component.
    - CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component.
    - CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component.
    - CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/Video component.
    - CVE-2026-8955: Privilege escalation in the DOM: Workers component.
    - CVE-2026-8956: Integer overflow in the Networking: JAR component.
    - CVE-2026-8957: Privilege escalation in the Enterprise Policies component.
    - CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
    - CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
    - CVE-2026-8961: Spoofing issue in the Form Autofill component.
    - CVE-2026-8962: Mitigation bypass in the DOM: Security component.
    - CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.
    - CVE-2026-8970: Privilege escalation in the Security component.
    - CVE-2026-8974: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151.
    - CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7f6ee801e2 advisory.

    Update NSS to 3.123.1     Update to Firefox 151.0


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1278:16 advisory.

    * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)
      * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)
      * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)
      * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)
      * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151     (CVE-2026-8975)
      * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)
      * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component     (CVE-2026-8968)
      * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)
      * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component     (CVE-2026-8958)
      * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)
      * firefox: Privilege escalation in the Security component (CVE-2026-8970)
      * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)
      * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)
      * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)
      * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component     (CVE-2026-8959)
      * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)
      * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)
      * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)
      * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
318638	RockyLinux 10 : firefox (RLSA-2026:21380)	Nessus	Rocky Linux Local Security Checks	2026/6/4	2026/6/4	critical
319498	RHEL 10 : thunderbird (RHSA-2026:22325)	Nessus	Red Hat Local Security Checks	2026/6/6	2026/6/6	critical
321940	RHEL 10 : firefox (RHSA-2026:27715)	Nessus	Red Hat Local Security Checks	2026/6/22	2026/6/22	critical
321330	RHEL 9 : firefox (RHSA-2026:26491)	Nessus	Red Hat Local Security Checks	2026/6/17	2026/6/17	critical
337037	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101375)	Nessus	Unity Linux Local Security Checks	2026/8/17	2026/8/17	high
315323	Mozilla Firefox < 151.0	Nessus	Windows	2026/5/19	2026/5/27	critical
315325	Mozilla Firefox ESR < 140.11	Nessus	Windows	2026/5/19	2026/7/22	critical
315967	Fedora 43 : firefox / nss (2026-cd20332935)	Nessus	Fedora Local Security Checks	2026/5/20	2026/5/22	critical
317447	Oracle Linux 8 : firefox (ELSA-2026-21382)	Nessus	Oracle Linux Local Security Checks	2026/5/28	2026/5/28	critical
317937	AlmaLinux 10 : firefox (ALSA-2026:21380)	Nessus	Alma Linux Local Security Checks	2026/5/29	2026/5/29	critical
316857	openSUSE 16 Security Update : MozillaFirefox (openSUSE-SU-2026:20789-1)	Nessus	SuSE Local Security Checks	2026/5/27	2026/5/27	critical
316628	Fedora 42 : firefox / nss (2026-7f6ee801e2)	Nessus	Fedora Local Security Checks	2026/5/25	2026/5/25	critical
328453	MiracleLinux 9 : thunderbird-140.11.0-1.el9_8.ML.1 (AXSA:2026-1278:16)	Nessus	Miracle Linux Local Security Checks	2026/7/20	2026/7/20	critical

检测

插件搜索

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical