How many Debian firefox CVEs are in CISA KEV?

Yes — 11 of Debian firefox's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Debian firefox are affected?

336 distinct Debian firefox versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Debian firefox CVEs?

Debian firefox's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write), CWE-1021 (Improper Restriction of Rendered UI Layers or Frames).

How many critical Debian firefox vulnerabilities are there?

Debian firefox has 412 critical and 775 high-severity CVEs.

What is the average severity of Debian firefox CVEs?

The average CVSS base score across Debian firefox's scored CVEs is 7.5.

Debian firefox Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Debian firefox vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

Debian firefox has 1,942 published CVE records since 2005, of which 11 are in CISA's Known Exploited Vulnerabilities catalog and 144 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Debian firefox, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Debian firefox's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical412

High775

Medium727

Low28

In CISA’s Known Exploited Vulnerabilities catalog

11

11 of Debian firefox's CVEs are confirmed exploited in the wild.

Public exploits

144

144 of Debian firefox's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Debian firefox version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 45.0-155 CVEs
< 148.0-149 CVEs
< 149.0-144 CVEs
< 150.0-140 CVEs
< 152.0-139 CVEs
< 52.0.1-137 CVEs
< 58.0-130 CVEs
< 151.0-127 CVEs
< 52.0-125 CVEs
< 55.0-125 CVEs
< 60.0-125 CVEs
< 68.0-122 CVEs
< 48.0-121 CVEs
< 51.0-121 CVEs
< 50.0-120 CVEs
< 54.0-120 CVEs
< 107.0-119 CVEs
< 49.0-118 CVEs
< 102.0-117 CVEs
< 59.0-117 CVEs
< 61.0-117 CVEs
< 66.0-117 CVEs
< 67.0-217 CVEs
< 69.0-117 CVEs
< 112.0-116 CVEs
< 121.0-116 CVEs
< 141.0-116 CVEs
< 145.0-116 CVEs
< 147.0-116 CVEs
< 56.0-116 CVEs
< 110.0-115 CVEs
< 126.0-115 CVEs
< 128.0-115 CVEs
< 57.0-115 CVEs
< 70.0-115 CVEs
< 83.0-115 CVEs
< 122.0-114 CVEs
< 125.0.1-114 CVEs
< 129.0-114 CVEs
< 134.0-114 CVEs
< 1.5.dfsg+1.5.0.2-213 CVEs
< 1.5.dfsg+1.5.0.4-113 CVEs
< 1.5.dfsg+1.5.0.5-113 CVEs
< 115.0-113 CVEs
< 127.0-113 CVEs
< 146.0-113 CVEs
< 50.1.0-113 CVEs
< 96.0-113 CVEs
< 99.0-113 CVEs
< 101.0-112 CVEs
< 116.0-112 CVEs
< 123.0-112 CVEs
< 47.0-112 CVEs
< 63.0-112 CVEs
< 74.0-112 CVEs
< 88.0-112 CVEs
< 1.5.dfsg+1.5.0.2-111 CVEs
< 113.0-111 CVEs
< 117.0-111 CVEs
< 124.0-111 CVEs
< 131.0-111 CVEs
< 132.0-111 CVEs
< 135.0-111 CVEs
< 64.0-111 CVEs
< 78.0-111 CVEs
< 84.0-111 CVEs
< 85.0-111 CVEs
< 94.0-111 CVEs
< 95.0-111 CVEs
< 120.0-110 CVEs
< 136.0-110 CVEs
< 140.0-110 CVEs
< 46.0-110 CVEs
< 86.0-110 CVEs
< 91.0-110 CVEs
< 1.5.dfsg+1.5.0.7-19 CVEs
< 106.0-19 CVEs
< 111.0-19 CVEs
< 119.0-19 CVEs
< 139.0-19 CVEs
< 143.0-19 CVEs
< 144.0-19 CVEs
< 79.0-19 CVEs
< 80.0-19 CVEs
< 87.0-19 CVEs
< 97.0-19 CVEs
< 1.5.dfsg+1.5.0.1-18 CVEs
< 100.0-18 CVEs
< 105.0-18 CVEs
< 109.0-18 CVEs
< 130.0-18 CVEs
< 133.0-18 CVEs
< 142.0-18 CVEs
< 62.0-18 CVEs
< 71.0-18 CVEs
< 76.0-18 CVEs
< 77.0-18 CVEs
< 93.0-18 CVEs
< 108.0-17 CVEs
< 118.0-17 CVEs
< 137.0-17 CVEs
< 138.0-17 CVEs
< 65.0-17 CVEs
< 72.0-17 CVEs
< 82.0-17 CVEs
< 90.0-17 CVEs
< 98.0-17 CVEs
< 103.0-16 CVEs
< 75.0-16 CVEs
< 81.0-16 CVEs
< 104.0-15 CVEs
< 149.0.2-15 CVEs
< 150.0.3-15 CVEs
< 89.0-15 CVEs
< 114.0-14 CVEs
< 150.0.1-14 CVEs
< 73.0-14 CVEs
< 1.5.dfsg-13 CVEs
< 150.0.2-13 CVEs
< 65.0.1-13 CVEs
< 92.0-13 CVEs
< 1.5.0.22 CVEs
< 1.5.dfsg+1.5.0.22 CVEs
< 100.0.2-12 CVEs
< 124.0.1-12 CVEs
< 138.0.4-12 CVEs
< 139.0.4-12 CVEs
< 143.0.3-12 CVEs
< 146.0.1-12 CVEs
< 147.0.2-12 CVEs
< 148.0.2-12 CVEs
< 151.0.3-12 CVEs
< 152.0.6-12 CVEs
< 50.0.2-12 CVEs
< 57.0.1-12 CVEs
< 59.0.1-12 CVEs
< 62.0.3-12 CVEs
< 66.0.1-12 CVEs
< 74.0.1-12 CVEs
< 1.51 CVE
< 1.5.0.2-11 CVE
< 1.5.dfsg+1.5.0.3-11 CVE
< 1.5.dfsg+1.5.0.3-21 CVE
< 1.5.dfsg+1.5.0.41 CVE
< 1.5.dfsg+1.5.0.6-11 CVE
< 115.0.2-11 CVE
< 117.0.1-11 CVE
< 131.0.2-11 CVE
< 131.0.3-11 CVE
< 135.0.1-11 CVE
< 137.0.2-11 CVE
< 144.0.2-11 CVE
< 147.0.4-11 CVE
< 152.0.4-11 CVE
< 58.0.1-11 CVE
< 59.0.2-11 CVE
< 60.0.2-11 CVE
< 62.0.2-11 CVE
< 67.0.3-11 CVE
< 67.0.4-11 CVE
< 68.0.2-11 CVE
< 69.0.1-11 CVE
< 72.0.1-11 CVE
< 78.0.2-11 CVE
< 82.0.3-11 CVE
< 84.0.2-11 CVE
< 88.0.1-11 CVE
< 91.0.1-11 CVE

Fixed in

45.0-155 CVEs
148.0-149 CVEs
149.0-144 CVEs
150.0-140 CVEs
152.0-139 CVEs
52.0.1-137 CVEs
58.0-130 CVEs
151.0-127 CVEs
52.0-125 CVEs
55.0-125 CVEs
60.0-125 CVEs
68.0-122 CVEs
48.0-121 CVEs
51.0-121 CVEs
50.0-120 CVEs
54.0-120 CVEs
107.0-119 CVEs
49.0-118 CVEs
102.0-117 CVEs
59.0-117 CVEs
61.0-117 CVEs
66.0-117 CVEs
67.0-217 CVEs
69.0-117 CVEs
112.0-116 CVEs
121.0-116 CVEs
141.0-116 CVEs
145.0-116 CVEs
147.0-116 CVEs
56.0-116 CVEs
110.0-115 CVEs
126.0-115 CVEs
128.0-115 CVEs
57.0-115 CVEs
70.0-115 CVEs
83.0-115 CVEs
122.0-114 CVEs
125.0.1-114 CVEs
129.0-114 CVEs
134.0-114 CVEs
1.5.dfsg+1.5.0.2-213 CVEs
1.5.dfsg+1.5.0.4-113 CVEs
1.5.dfsg+1.5.0.5-113 CVEs
115.0-113 CVEs
127.0-113 CVEs
146.0-113 CVEs
50.1.0-113 CVEs
96.0-113 CVEs
99.0-113 CVEs
101.0-112 CVEs
116.0-112 CVEs
123.0-112 CVEs
47.0-112 CVEs
63.0-112 CVEs
74.0-112 CVEs
88.0-112 CVEs
1.5.dfsg+1.5.0.2-111 CVEs
113.0-111 CVEs
117.0-111 CVEs
124.0-111 CVEs
131.0-111 CVEs
132.0-111 CVEs
135.0-111 CVEs
64.0-111 CVEs
78.0-111 CVEs
84.0-111 CVEs
85.0-111 CVEs
94.0-111 CVEs
95.0-111 CVEs
120.0-110 CVEs
136.0-110 CVEs
140.0-110 CVEs
46.0-110 CVEs
86.0-110 CVEs
91.0-110 CVEs
1.5.dfsg+1.5.0.7-19 CVEs
106.0-19 CVEs
111.0-19 CVEs
119.0-19 CVEs
139.0-19 CVEs
143.0-19 CVEs
144.0-19 CVEs
79.0-19 CVEs
80.0-19 CVEs
87.0-19 CVEs
97.0-19 CVEs
1.5.dfsg+1.5.0.1-18 CVEs
100.0-18 CVEs
105.0-18 CVEs
109.0-18 CVEs
130.0-18 CVEs
133.0-18 CVEs
142.0-18 CVEs
62.0-18 CVEs
71.0-18 CVEs
76.0-18 CVEs
77.0-18 CVEs
93.0-18 CVEs
108.0-17 CVEs
118.0-17 CVEs
137.0-17 CVEs
138.0-17 CVEs
65.0-17 CVEs
72.0-17 CVEs
82.0-17 CVEs
90.0-17 CVEs
98.0-17 CVEs
103.0-16 CVEs
75.0-16 CVEs
81.0-16 CVEs
104.0-15 CVEs
149.0.2-15 CVEs
150.0.3-15 CVEs
89.0-15 CVEs
114.0-14 CVEs
150.0.1-14 CVEs
73.0-14 CVEs
1.5.dfsg-13 CVEs
150.0.2-13 CVEs
65.0.1-13 CVEs
92.0-13 CVEs
1.5.0.22 CVEs
1.5.dfsg+1.5.0.22 CVEs
100.0.2-12 CVEs
124.0.1-12 CVEs
138.0.4-12 CVEs
139.0.4-12 CVEs
143.0.3-12 CVEs
146.0.1-12 CVEs
147.0.2-12 CVEs
148.0.2-12 CVEs
151.0.3-12 CVEs
152.0.6-12 CVEs
50.0.2-12 CVEs
57.0.1-12 CVEs
59.0.1-12 CVEs
62.0.3-12 CVEs
66.0.1-12 CVEs
74.0.1-12 CVEs
1.51 CVE
1.5.0.2-11 CVE
1.5.dfsg+1.5.0.3-11 CVE
1.5.dfsg+1.5.0.3-21 CVE
1.5.dfsg+1.5.0.41 CVE
1.5.dfsg+1.5.0.6-11 CVE
115.0.2-11 CVE
117.0.1-11 CVE
131.0.2-11 CVE
131.0.3-11 CVE
135.0.1-11 CVE
137.0.2-11 CVE
144.0.2-11 CVE
147.0.4-11 CVE
152.0.4-11 CVE
58.0.1-11 CVE
59.0.2-11 CVE
60.0.2-11 CVE
62.0.2-11 CVE
67.0.3-11 CVE
67.0.4-11 CVE
68.0.2-11 CVE
69.0.1-11 CVE
72.0.1-11 CVE
78.0.2-11 CVE
82.0.3-11 CVE
84.0.2-11 CVE
88.0.1-11 CVE
91.0.1-11 CVE

Find a version

1,942 CVEs

Sort

Site isolation in the DOM: Navigation component
CVE-2026-15719
Patch
Medium · CVSS 5.4
EPSS 0.1% (3th pct)2026-07-14
Invalid pointer in the JavaScript: WebAssembly component
CVE-2026-15718
Patch
CWE-763
Medium · CVSS 4.3
EPSS 0.2% (5th pct)2026-07-14
Memory safety bugs fixed in Firefox 152.0.4
CVE-2026-14241
Patch
CWE-119
Critical · CVSS 9.8
EPSS 0.2% (14th pct)2026-06-30
Cookie injection was possible when opening a PDF link
CVE-2026-53900
Patch
CWE-384
Medium · CVSS 4.3
EPSS 0.1% (1th pct)2026-06-16
Cross-origin cookies could be leaked when opening a PDF link
CVE-2026-53899
Patch
CWE-345
Medium · CVSS 6.5
EPSS 0.1% (1th pct)2026-06-16
Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
CVE-2026-12328
Patch
CWE-120
High · CVSS 8.1
EPSS 0.5% (38th pct)2026-06-16
Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
CVE-2026-12327
Patch
CWE-119
High · CVSS 8.1
EPSS 0.4% (33th pct)2026-06-16
Memory safety bugs fixed in Firefox 152 and Thunderbird 152
CVE-2026-12326
Patch
CWE-119
High · CVSS 8.1
EPSS 0.3% (16th pct)2026-06-16
Denial-of-service in the Graphics: ImageLib component
CVE-2026-12325
Patch
CWE-400
Medium · CVSS 6.5
EPSS 0.2% (13th pct)2026-06-16
Incorrect boundary conditions in the Graphics: CanvasWebGL component
CVE-2026-12324
Patch
CWE-703
High · CVSS 7.3
EPSS 0.2% (11th pct)2026-06-16
Spoofing issue in the DOM: Core & HTML component
CVE-2026-12323
Patch
CWE-1021
Medium · CVSS 5.4
EPSS 0.2% (6th pct)2026-06-16
Clickjacking issue in the Widget: Gtk component
CVE-2026-12322
Patch
CWE-1021
Medium · CVSS 5.4
EPSS 0.2% (6th pct)2026-06-16
JIT miscompilation in the JavaScript: WebAssembly component
CVE-2026-12321
Patch
CWE-670
Medium · CVSS 5.4
EPSS 0.2% (5th pct)2026-06-16
Information disclosure in the Password Manager component
CVE-2026-12320
Patch
CWE-200
Medium · CVSS 4.3
EPSS 0.2% (8th pct)2026-06-16
Denial-of-service in the Audio/Video: Playback component
CVE-2026-12319
Patch
CWE-400
Medium · CVSS 6.5
EPSS 0.2% (11th pct)2026-06-16
Incorrect boundary conditions in the Libraries component in NSS
CVE-2026-12318
Patch
CWE-119
High · CVSS 7.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12317
Patch
CWE-119
High · CVSS 7.5
EPSS 0.3% (21th pct)2026-06-16
Mitigation bypass in the DOM: Security component
CVE-2026-12316
Patch
CWE-693
Critical · CVSS 9.1
EPSS 0.2% (16th pct)2026-06-16
Mitigation bypass in the DOM: Security component
CVE-2026-12315
Patch
CWE-693
Critical · CVSS 9.1
EPSS 0.3% (16th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12314
Patch
CWE-787
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-06-16
Information disclosure, sandbox escape in the Security: Process Sandboxing component
CVE-2026-12313
Patch
CWE-269
Medium · CVSS 4.7
EPSS 0.2% (7th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12312
Patch
CWE-119
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-06-16
Information disclosure, sandbox escape in the Security: Process Sandboxing component
CVE-2026-12311
Patch
CWE-200
Medium · CVSS 4.7
EPSS 0.2% (8th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12310
Patch
CWE-787
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12309
Patch
CWE-119
Medium · CVSS 6.5
EPSS 0.2% (14th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12308
Patch
CWE-119
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12307
Patch
CWE-119
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12306
Patch
CWE-119
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12305
Patch
CWE-119
High · CVSS 7.5
EPSS 0.4% (30th pct)2026-06-16
Same-origin policy bypass in the Networking: Cookies component
CVE-2026-12304
Patch
CWE-346
Critical · CVSS 9.1
EPSS 0.2% (9th pct)2026-06-16

Showing 30 of 1,942

Common weakness types

The CWE weakness categories most often found in Debian firefox CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Debian firefox CVEs were published each year.

2007

1

2016

108

2017

2

2018

334

2019

136

2020

160

2021

135

2022

157

2023

179

2024

189

2025

181

2026

257

Other Debian products

Browse vulnerabilities for other products by Debian.

linux15,165 CVEs debian linux10,068 CVEs chromium3,665 CVEs linux-6.13,436 CVEs firefox-esr1,153 CVEs thunderbird1,015 CVEs imagemagick812 CVEs wireshark750 CVEs

All Debian vulnerabilities

Frequently asked questions

Common questions about Debian firefox vulnerabilities.

How many CVEs does Debian firefox have?: Debian firefox has 1,942 published CVE records since 2005.
How many Debian firefox CVEs are in CISA KEV?: Yes — 11 of Debian firefox's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Debian firefox vulnerabilities?: Yes — 144 of Debian firefox's CVEs have a known public exploit.
Which versions of Debian firefox are affected?: 336 distinct Debian firefox versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Debian firefox CVEs?: Debian firefox's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write), CWE-1021 (Improper Restriction of Rendered UI Layers or Frames).
How many critical Debian firefox vulnerabilities are there?: Debian firefox has 412 critical and 775 high-severity CVEs.
What is the average severity of Debian firefox CVEs?: The average CVSS base score across Debian firefox's scored CVEs is 7.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.