How many Debian firefox-esr CVEs are in CISA KEV?

Yes — 11 of Debian firefox-esr's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Debian firefox-esr are affected?

526 distinct Debian firefox-esr versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Debian firefox-esr CVEs?

Debian firefox-esr's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write), CWE-754 (Improper Check for Unusual or Exceptional Conditions).

How many critical Debian firefox-esr vulnerabilities are there?

Debian firefox-esr has 278 critical and 505 high-severity CVEs.

What is the average severity of Debian firefox-esr CVEs?

The average CVSS base score across Debian firefox-esr's scored CVEs is 7.8.

Debian

1,153 CVEs

11 in CISA KEV

deb:bookworm

deb:bullseye

deb:forky

deb:sid

deb:trixie

Debian firefox-esr Vulnerabilities

Name: Debian firefox-esr vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for firefox-esr by Debian.

1,153

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.8

Avg CVSS

2006–2026

Last updated June 16, 2026

Overview

Debian firefox-esr has 1,153 published CVE records since 2006, of which 11 are in CISA's Known Exploited Vulnerabilities catalog and 98 have a known public exploit. The average CVSS base score across scored CVEs is 7.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Debian firefox-esr, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Debian firefox-esr's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical278

High505

Medium364

Low6

In CISA’s Known Exploited Vulnerabilities catalog

11 of Debian firefox-esr's CVEs are confirmed exploited in the wild.

Public exploits

98 of Debian firefox-esr's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Debian firefox-esr version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 45.0esr-155 CVEs
< 140.8.0esr-138 CVEs
< 140.8.0esr-1~deb11u137 CVEs
< 140.8.0esr-1~deb12u137 CVEs
< 140.8.0esr-1~deb13u137 CVEs
< 140.9.0esr-136 CVEs
< 140.9.0esr-1~deb11u136 CVEs
< 140.9.0esr-1~deb12u136 CVEs
< 140.9.0esr-1~deb13u136 CVEs
< 140.12.0esr-129 CVEs
< 140.12.0esr-1~deb11u129 CVEs
< 140.12.0esr-1~deb12u129 CVEs
< 140.12.0esr-1~deb13u129 CVEs
< 140.10.0esr-124 CVEs
< 140.10.0esr-1~deb11u124 CVEs
< 140.10.0esr-1~deb12u124 CVEs
< 140.10.0esr-1~deb13u124 CVEs
< 45.9.0esr-124 CVEs
< 140.11.0esr-118 CVEs
< 140.11.0esr-1~deb11u118 CVEs
< 140.11.0esr-1~deb12u118 CVEs
< 140.11.0esr-1~deb13u118 CVEs
< 52.2.0esr-118 CVEs
< 91.4.1esr-1~deb11u118 CVEs
< 52.3.0esr-115 CVEs
< 102.5.0esr-113 CVEs
< 102.5.0esr-1~deb11u113 CVEs
< 140.7.0esr-113 CVEs
< 140.7.0esr-1~deb11u113 CVEs
< 140.7.0esr-1~deb12u113 CVEs
< 140.7.0esr-1~deb13u113 CVEs
< 60.7.0esr-113 CVEs
< 68.1.0esr-113 CVEs
< 115.2.0esr-112 CVEs
< 45.3.0esr-112 CVEs
< 45.4.0esr-112 CVEs
< 91.5.0esr-112 CVEs
< 91.5.0esr-1~deb11u112 CVEs
< 102.8.0esr-111 CVEs
< 102.8.0esr-1~deb11u111 CVEs
< 115.6.0esr-111 CVEs
< 115.6.0esr-1~deb11u111 CVEs
< 115.6.0esr-1~deb12u111 CVEs
< 52.6.0esr-111 CVEs
< 128.4.0esr-110 CVEs
< 128.4.0esr-1~deb11u110 CVEs
< 128.4.0esr-1~deb12u110 CVEs
< 140.6.0esr-110 CVEs
< 140.6.0esr-1~deb11u110 CVEs
< 140.6.0esr-1~deb12u110 CVEs
< 140.6.0esr-1~deb13u110 CVEs
< 45.6.0esr-110 CVEs
< 60.8.0esr-110 CVEs
< 78.5.0esr-110 CVEs
< 91.4.0esr-110 CVEs
< 102.10.0esr-19 CVEs
< 102.10.0esr-1~deb11u19 CVEs
< 115.1.0esr-19 CVEs
< 115.14.0esr-19 CVEs
< 115.14.0esr-1~deb11u19 CVEs
< 115.14.0esr-1~deb12u19 CVEs
< 115.7.0esr-19 CVEs
< 115.7.0esr-1~deb11u19 CVEs
< 115.7.0esr-1~deb12u19 CVEs
< 115.9.0esr-19 CVEs
< 115.9.0esr-1~deb11u19 CVEs
< 115.9.0esr-1~deb12u19 CVEs
< 128.13.0esr-19 CVEs
< 128.13.0esr-1~deb11u19 CVEs
< 128.13.0esr-1~deb12u19 CVEs
< 128.7.0esr-19 CVEs
< 128.7.0esr-1~deb11u19 CVEs
< 128.7.0esr-1~deb12u19 CVEs
< 128.8.0esr-19 CVEs
< 128.8.0esr-1~deb11u19 CVEs
< 128.8.0esr-1~deb12u19 CVEs
< 140.5.0esr-19 CVEs
< 140.5.0esr-1~deb11u19 CVEs
< 140.5.0esr-1~deb12u19 CVEs
< 140.5.0esr-1~deb13u19 CVEs
< 45.7.0esr-19 CVEs
< 45.8.0esr-19 CVEs
< 52.8.0esr-19 CVEs
< 52.9.0esr-19 CVEs
< 68.2.0esr-19 CVEs
< 102.14.0esr-1~deb11u18 CVEs
< 102.14.0esr-1~deb12u18 CVEs
< 115.10.0esr-18 CVEs
< 115.10.0esr-1~deb11u18 CVEs
< 115.10.0esr-1~deb12u18 CVEs
< 115.8.0esr-18 CVEs
< 115.8.0esr-1~deb11u18 CVEs
< 115.8.0esr-1~deb12u18 CVEs
< 52.4.0esr-28 CVEs
< 60.6.0esr-18 CVEs
< 78.10.0esr-18 CVEs
< 91.11.0esr-18 CVEs
< 91.11.0esr-1~deb11u18 CVEs
< 91.3.0esr-18 CVEs
< 91.8.0esr-18 CVEs
< 91.8.0esr-1~deb11u18 CVEs
< 102.11.0esr-17 CVEs
< 102.11.0esr-1~deb11u17 CVEs
< 102.3.0esr-17 CVEs
< 102.3.0esr-1~deb11u17 CVEs
< 102.7.0esr-17 CVEs
< 102.7.0esr-1~deb11u17 CVEs
< 115.12.0esr-17 CVEs
< 115.12.0esr-1~deb11u17 CVEs
< 115.12.0esr-1~deb12u17 CVEs
< 115.5.0esr-17 CVEs
< 115.5.0esr-1~deb11u17 CVEs
< 115.5.0esr-1~deb12u17 CVEs
< 128.11.0esr-17 CVEs
< 128.11.0esr-1~deb11u17 CVEs
< 128.11.0esr-1~deb12u17 CVEs
< 128.6.0esr-17 CVEs
< 128.6.0esr-1~deb11u37 CVEs
< 128.6.0esr-1~deb12u17 CVEs
< 140.3.0esr-17 CVEs
< 140.3.0esr-1~deb11u27 CVEs
< 140.3.0esr-1~deb12u17 CVEs
< 140.3.0esr-1~deb13u17 CVEs
< 140.4.0esr-17 CVEs
< 140.4.0esr-1~deb11u17 CVEs
< 140.4.0esr-1~deb12u17 CVEs
< 140.4.0esr-1~deb13u17 CVEs
< 45.5.0esr-17 CVEs
< 52.7.0esr-17 CVEs
< 60.3.0esr-17 CVEs
< 68.6.0esr-17 CVEs
< 78.6.0esr-17 CVEs
< 91.10.0esr-17 CVEs
< 91.10.0esr-1~deb11u17 CVEs
< 91.6.0esr-17 CVEs
< 91.6.0esr-1~deb11u17 CVEs
< 102.6.0esr-16 CVEs
< 102.6.0esr-1~deb11u16 CVEs
< 115.11.0esr-16 CVEs
< 115.11.0esr-1~deb11u16 CVEs
< 115.11.0esr-1~deb12u16 CVEs
< 115.4.0esr-16 CVEs
< 115.4.0esr-1~deb11u16 CVEs
< 115.4.0esr-1~deb12u16 CVEs
< 128.10.1esr-1~deb11u16 CVEs
< 128.5.0esr-16 CVEs
< 128.5.0esr-1~deb11u16 CVEs
< 128.5.0esr-1~deb12u16 CVEs
< 45.2.0esr-16 CVEs
< 60.2.0esr-16 CVEs
< 60.4.0esr-16 CVEs
< 78.13.0esr-16 CVEs
< 78.13.0esr-1~deb11u16 CVEs
< 78.9.0esr-16 CVEs
< 91.9.0esr-16 CVEs
< 91.9.0esr-1~deb11u16 CVEs
< 102.13.0esr-15 CVEs
< 102.13.0esr-1~deb11u15 CVEs
< 102.13.0esr-1~deb12u15 CVEs
< 102.15.0esr-1~deb11u15 CVEs
< 102.15.0esr-1~deb12u15 CVEs
< 102.2.0esr-15 CVEs
< 102.9.0esr-15 CVEs
< 102.9.0esr-1~deb11u15 CVEs
< 115.13.0esr-15 CVEs
< 115.13.0esr-1~deb11u15 CVEs
< 115.13.0esr-1~deb12u15 CVEs
< 140.10.1esr-15 CVEs
< 140.10.1esr-1~deb11u15 CVEs
< 140.10.1esr-1~deb12u15 CVEs
< 140.10.1esr-1~deb13u15 CVEs
< 68.10.0esr-15 CVEs
< 68.3.0esr-15 CVEs
< 78.7.0esr-15 CVEs
< 91.7.0esr-15 CVEs
< 91.7.0esr-1~deb11u15 CVEs
< 102.4.0esr-14 CVEs
< 102.4.0esr-1~deb11u14 CVEs
< 115.15.0esr-14 CVEs
< 115.15.0esr-1~deb11u14 CVEs
< 115.15.0esr-1~deb12u14 CVEs
< 128.10.0esr-14 CVEs
< 128.10.0esr-1~deb12u14 CVEs
< 128.12.0esr-14 CVEs
< 128.12.0esr-1~deb11u14 CVEs
< 128.12.0esr-1~deb12u14 CVEs
< 128.14.0esr-14 CVEs
< 128.14.0esr-1~deb11u14 CVEs
< 128.14.0esr-1~deb12u14 CVEs
< 128.14.0esr-1~deb13u14 CVEs
< 128.3.0esr-14 CVEs
< 128.3.0esr-1~deb11u24 CVEs
< 128.3.0esr-1~deb12u14 CVEs
< 45.1.0esr-14 CVEs
< 68.11.0esr-14 CVEs
< 68.4.0esr-14 CVEs
< 68.8.0esr-14 CVEs
< 68.9.0esr-14 CVEs
< 78.3.0esr-14 CVEs
< 78.8.0esr-14 CVEs
< 115.3.0esr-13 CVEs
< 115.3.0esr-1~deb11u13 CVEs
< 115.3.0esr-1~deb12u13 CVEs
< 128.9.0esr-13 CVEs
< 128.9.0esr-1~deb11u13 CVEs
< 128.9.0esr-1~deb12u13 CVEs
< 140.10.2esr-13 CVEs
< 140.10.2esr-1~deb11u13 CVEs
< 140.10.2esr-1~deb12u13 CVEs
< 140.10.2esr-1~deb13u13 CVEs
< 140.9.1esr-13 CVEs
< 140.9.1esr-1~deb11u13 CVEs
< 140.9.1esr-1~deb12u13 CVEs
< 140.9.1esr-1~deb13u13 CVEs
< 52.5.0esr-13 CVEs
< 60.5.0esr-13 CVEs
< 68.5.0esr-13 CVEs
< 68.7.0esr-13 CVEs
< 78.12.0esr-13 CVEs
< 91.13.0esr-1~deb11u13 CVEs
< 102.12.0esr-12 CVEs
< 102.12.0esr-1~deb11u12 CVEs
< 102.12.0esr-1~deb12u12 CVEs
< 128.10.1esr-12 CVEs
< 128.10.1esr-1~deb12u12 CVEs
< 52.7.2esr-12 CVEs
< 60.2.1esr-12 CVEs
< 60.2.2esr-12 CVEs
< 60.5.1esr-12 CVEs
< 60.6.1esr-12 CVEs
< 68.12.0esr-12 CVEs
< 68.6.1esr-12 CVEs
< 78.15.0esr-1~deb11u12 CVEs
< 78.4.0esr-12 CVEs
< 91.12.0esr-12 CVEs
< 91.12.0esr-1~deb11u12 CVEs
< 91.2.0esr-12 CVEs
< 91.6.1esr-12 CVEs
< 91.6.1esr-1~deb11u12 CVEs
< 91.9.1esr-12 CVEs
< 91.9.1esr-1~deb11u12 CVEs
< 102.15.1esr-1~deb11u11 CVE
< 102.15.1esr-1~deb12u11 CVE
< 115.2.1esr-11 CVE
< 115.3.1esr-1~deb11u11 CVE
< 115.9.1esr-11 CVE
< 115.9.1esr-1~deb11u11 CVE
< 115.9.1esr-1~deb12u11 CVE
< 128.3.1esr-11 CVE
< 128.3.1esr-1~deb11u11 CVE
< 128.3.1esr-1~deb12u11 CVE
< 45.5.1esr-11 CVE
< 52.5.2esr-11 CVE
< 52.7.3esr-11 CVE
< 52.8.1esr-11 CVE
< 60.7.1esr-11 CVE
< 60.7.2esr-11 CVE
< 68.4.1esr-11 CVE
< 78.11.0esr-11 CVE
< 78.14.0esr-11 CVE
< 78.14.0esr-1~deb11u11 CVE
< 78.4.1esr-11 CVE
< 78.6.1esr-11 CVE

Fixed in

45.0esr-155 CVEs
140.8.0esr-138 CVEs
140.8.0esr-1~deb11u137 CVEs
140.8.0esr-1~deb12u137 CVEs
140.8.0esr-1~deb13u137 CVEs
140.9.0esr-136 CVEs
140.9.0esr-1~deb11u136 CVEs
140.9.0esr-1~deb12u136 CVEs
140.9.0esr-1~deb13u136 CVEs
140.12.0esr-129 CVEs
140.12.0esr-1~deb11u129 CVEs
140.12.0esr-1~deb12u129 CVEs
140.12.0esr-1~deb13u129 CVEs
140.10.0esr-124 CVEs
140.10.0esr-1~deb11u124 CVEs
140.10.0esr-1~deb12u124 CVEs
140.10.0esr-1~deb13u124 CVEs
45.9.0esr-124 CVEs
140.11.0esr-118 CVEs
140.11.0esr-1~deb11u118 CVEs
140.11.0esr-1~deb12u118 CVEs
140.11.0esr-1~deb13u118 CVEs
52.2.0esr-118 CVEs
91.4.1esr-1~deb11u118 CVEs
52.3.0esr-115 CVEs
102.5.0esr-113 CVEs
102.5.0esr-1~deb11u113 CVEs
140.7.0esr-113 CVEs
140.7.0esr-1~deb11u113 CVEs
140.7.0esr-1~deb12u113 CVEs
140.7.0esr-1~deb13u113 CVEs
60.7.0esr-113 CVEs
68.1.0esr-113 CVEs
115.2.0esr-112 CVEs
45.3.0esr-112 CVEs
45.4.0esr-112 CVEs
91.5.0esr-112 CVEs
91.5.0esr-1~deb11u112 CVEs
102.8.0esr-111 CVEs
102.8.0esr-1~deb11u111 CVEs
115.6.0esr-111 CVEs
115.6.0esr-1~deb11u111 CVEs
115.6.0esr-1~deb12u111 CVEs
52.6.0esr-111 CVEs
128.4.0esr-110 CVEs
128.4.0esr-1~deb11u110 CVEs
128.4.0esr-1~deb12u110 CVEs
140.6.0esr-110 CVEs
140.6.0esr-1~deb11u110 CVEs
140.6.0esr-1~deb12u110 CVEs
140.6.0esr-1~deb13u110 CVEs
45.6.0esr-110 CVEs
60.8.0esr-110 CVEs
78.5.0esr-110 CVEs
91.4.0esr-110 CVEs
102.10.0esr-19 CVEs
102.10.0esr-1~deb11u19 CVEs
115.1.0esr-19 CVEs
115.14.0esr-19 CVEs
115.14.0esr-1~deb11u19 CVEs
115.14.0esr-1~deb12u19 CVEs
115.7.0esr-19 CVEs
115.7.0esr-1~deb11u19 CVEs
115.7.0esr-1~deb12u19 CVEs
115.9.0esr-19 CVEs
115.9.0esr-1~deb11u19 CVEs
115.9.0esr-1~deb12u19 CVEs
128.13.0esr-19 CVEs
128.13.0esr-1~deb11u19 CVEs
128.13.0esr-1~deb12u19 CVEs
128.7.0esr-19 CVEs
128.7.0esr-1~deb11u19 CVEs
128.7.0esr-1~deb12u19 CVEs
128.8.0esr-19 CVEs
128.8.0esr-1~deb11u19 CVEs
128.8.0esr-1~deb12u19 CVEs
140.5.0esr-19 CVEs
140.5.0esr-1~deb11u19 CVEs
140.5.0esr-1~deb12u19 CVEs
140.5.0esr-1~deb13u19 CVEs
45.7.0esr-19 CVEs
45.8.0esr-19 CVEs
52.8.0esr-19 CVEs
52.9.0esr-19 CVEs
68.2.0esr-19 CVEs
102.14.0esr-1~deb11u18 CVEs
102.14.0esr-1~deb12u18 CVEs
115.10.0esr-18 CVEs
115.10.0esr-1~deb11u18 CVEs
115.10.0esr-1~deb12u18 CVEs
115.8.0esr-18 CVEs
115.8.0esr-1~deb11u18 CVEs
115.8.0esr-1~deb12u18 CVEs
52.4.0esr-28 CVEs
60.6.0esr-18 CVEs
78.10.0esr-18 CVEs
91.11.0esr-18 CVEs
91.11.0esr-1~deb11u18 CVEs
91.3.0esr-18 CVEs
91.8.0esr-18 CVEs
91.8.0esr-1~deb11u18 CVEs
102.11.0esr-17 CVEs
102.11.0esr-1~deb11u17 CVEs
102.3.0esr-17 CVEs
102.3.0esr-1~deb11u17 CVEs
102.7.0esr-17 CVEs
102.7.0esr-1~deb11u17 CVEs
115.12.0esr-17 CVEs
115.12.0esr-1~deb11u17 CVEs
115.12.0esr-1~deb12u17 CVEs
115.5.0esr-17 CVEs
115.5.0esr-1~deb11u17 CVEs
115.5.0esr-1~deb12u17 CVEs
128.11.0esr-17 CVEs
128.11.0esr-1~deb11u17 CVEs
128.11.0esr-1~deb12u17 CVEs
128.6.0esr-17 CVEs
128.6.0esr-1~deb11u37 CVEs
128.6.0esr-1~deb12u17 CVEs
140.3.0esr-17 CVEs
140.3.0esr-1~deb11u27 CVEs
140.3.0esr-1~deb12u17 CVEs
140.3.0esr-1~deb13u17 CVEs
140.4.0esr-17 CVEs
140.4.0esr-1~deb11u17 CVEs
140.4.0esr-1~deb12u17 CVEs
140.4.0esr-1~deb13u17 CVEs
45.5.0esr-17 CVEs
52.7.0esr-17 CVEs
60.3.0esr-17 CVEs
68.6.0esr-17 CVEs
78.6.0esr-17 CVEs
91.10.0esr-17 CVEs
91.10.0esr-1~deb11u17 CVEs
91.6.0esr-17 CVEs
91.6.0esr-1~deb11u17 CVEs
102.6.0esr-16 CVEs
102.6.0esr-1~deb11u16 CVEs
115.11.0esr-16 CVEs
115.11.0esr-1~deb11u16 CVEs
115.11.0esr-1~deb12u16 CVEs
115.4.0esr-16 CVEs
115.4.0esr-1~deb11u16 CVEs
115.4.0esr-1~deb12u16 CVEs
128.10.1esr-1~deb11u16 CVEs
128.5.0esr-16 CVEs
128.5.0esr-1~deb11u16 CVEs
128.5.0esr-1~deb12u16 CVEs
45.2.0esr-16 CVEs
60.2.0esr-16 CVEs
60.4.0esr-16 CVEs
78.13.0esr-16 CVEs
78.13.0esr-1~deb11u16 CVEs
78.9.0esr-16 CVEs
91.9.0esr-16 CVEs
91.9.0esr-1~deb11u16 CVEs
102.13.0esr-15 CVEs
102.13.0esr-1~deb11u15 CVEs
102.13.0esr-1~deb12u15 CVEs
102.15.0esr-1~deb11u15 CVEs
102.15.0esr-1~deb12u15 CVEs
102.2.0esr-15 CVEs
102.9.0esr-15 CVEs
102.9.0esr-1~deb11u15 CVEs
115.13.0esr-15 CVEs
115.13.0esr-1~deb11u15 CVEs
115.13.0esr-1~deb12u15 CVEs
140.10.1esr-15 CVEs
140.10.1esr-1~deb11u15 CVEs
140.10.1esr-1~deb12u15 CVEs
140.10.1esr-1~deb13u15 CVEs
68.10.0esr-15 CVEs
68.3.0esr-15 CVEs
78.7.0esr-15 CVEs
91.7.0esr-15 CVEs
91.7.0esr-1~deb11u15 CVEs
102.4.0esr-14 CVEs
102.4.0esr-1~deb11u14 CVEs
115.15.0esr-14 CVEs
115.15.0esr-1~deb11u14 CVEs
115.15.0esr-1~deb12u14 CVEs
128.10.0esr-14 CVEs
128.10.0esr-1~deb12u14 CVEs
128.12.0esr-14 CVEs
128.12.0esr-1~deb11u14 CVEs
128.12.0esr-1~deb12u14 CVEs
128.14.0esr-14 CVEs
128.14.0esr-1~deb11u14 CVEs
128.14.0esr-1~deb12u14 CVEs
128.14.0esr-1~deb13u14 CVEs
128.3.0esr-14 CVEs
128.3.0esr-1~deb11u24 CVEs
128.3.0esr-1~deb12u14 CVEs
45.1.0esr-14 CVEs
68.11.0esr-14 CVEs
68.4.0esr-14 CVEs
68.8.0esr-14 CVEs
68.9.0esr-14 CVEs
78.3.0esr-14 CVEs
78.8.0esr-14 CVEs
115.3.0esr-13 CVEs
115.3.0esr-1~deb11u13 CVEs
115.3.0esr-1~deb12u13 CVEs
128.9.0esr-13 CVEs
128.9.0esr-1~deb11u13 CVEs
128.9.0esr-1~deb12u13 CVEs
140.10.2esr-13 CVEs
140.10.2esr-1~deb11u13 CVEs
140.10.2esr-1~deb12u13 CVEs
140.10.2esr-1~deb13u13 CVEs
140.9.1esr-13 CVEs
140.9.1esr-1~deb11u13 CVEs
140.9.1esr-1~deb12u13 CVEs
140.9.1esr-1~deb13u13 CVEs
52.5.0esr-13 CVEs
60.5.0esr-13 CVEs
68.5.0esr-13 CVEs
68.7.0esr-13 CVEs
78.12.0esr-13 CVEs
91.13.0esr-1~deb11u13 CVEs
102.12.0esr-12 CVEs
102.12.0esr-1~deb11u12 CVEs
102.12.0esr-1~deb12u12 CVEs
128.10.1esr-12 CVEs
128.10.1esr-1~deb12u12 CVEs
52.7.2esr-12 CVEs
60.2.1esr-12 CVEs
60.2.2esr-12 CVEs
60.5.1esr-12 CVEs
60.6.1esr-12 CVEs
68.12.0esr-12 CVEs
68.6.1esr-12 CVEs
78.15.0esr-1~deb11u12 CVEs
78.4.0esr-12 CVEs
91.12.0esr-12 CVEs
91.12.0esr-1~deb11u12 CVEs
91.2.0esr-12 CVEs
91.6.1esr-12 CVEs
91.6.1esr-1~deb11u12 CVEs
91.9.1esr-12 CVEs
91.9.1esr-1~deb11u12 CVEs
102.15.1esr-1~deb11u11 CVE
102.15.1esr-1~deb12u11 CVE
115.2.1esr-11 CVE
115.3.1esr-1~deb11u11 CVE
115.9.1esr-11 CVE
115.9.1esr-1~deb11u11 CVE
115.9.1esr-1~deb12u11 CVE
128.3.1esr-11 CVE
128.3.1esr-1~deb11u11 CVE
128.3.1esr-1~deb12u11 CVE
45.5.1esr-11 CVE
52.5.2esr-11 CVE
52.7.3esr-11 CVE
52.8.1esr-11 CVE
60.7.1esr-11 CVE
60.7.2esr-11 CVE
68.4.1esr-11 CVE
78.11.0esr-11 CVE
78.14.0esr-11 CVE
78.14.0esr-1~deb11u11 CVE
78.4.1esr-11 CVE
78.6.1esr-11 CVE

Find a version

1,153 CVEs

Sort

Incorrect boundary conditions in the Internationalization component
CVE-2026-12330
Patch
CWE-119
Medium · CVSS 5.4
EPSS 0.2% (6th pct)2026-06-16
Memory safety bug fixed in Thunderbird ESR 140.12
CVE-2026-12329
Patch
CWE-119
High · CVSS 7.5
EPSS 0.3% (25th pct)2026-06-16
Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
CVE-2026-12328
Patch
CWE-120
High · CVSS 8.1
EPSS 0.5% (38th pct)2026-06-16
Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152
CVE-2026-12327
Patch
CWE-119
High · CVSS 8.1
EPSS 0.4% (33th pct)2026-06-16
Denial-of-service in the Graphics: ImageLib component
CVE-2026-12325
Patch
CWE-400
Medium · CVSS 6.5
EPSS 0.2% (13th pct)2026-06-16
Incorrect boundary conditions in the Graphics: CanvasWebGL component
CVE-2026-12324
Patch
CWE-703
High · CVSS 7.3
EPSS 0.2% (11th pct)2026-06-16
Mitigation bypass in the DOM: Security component
CVE-2026-12315
Patch
CWE-693
Critical · CVSS 9.1
EPSS 0.3% (16th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12314
Patch
CWE-787
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-06-16
Information disclosure, sandbox escape in the Security: Process Sandboxing component
CVE-2026-12313
Patch
CWE-269
Medium · CVSS 4.7
EPSS 0.2% (7th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12312
Patch
CWE-119
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-06-16
Information disclosure, sandbox escape in the Security: Process Sandboxing component
CVE-2026-12311
Patch
CWE-200
Medium · CVSS 4.7
EPSS 0.2% (8th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12310
Patch
CWE-787
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12309
Patch
CWE-119
Medium · CVSS 6.5
EPSS 0.2% (14th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12308
Patch
CWE-119
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12307
Patch
CWE-119
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12306
Patch
CWE-119
Medium · CVSS 5.3
EPSS 0.3% (18th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12305
Patch
CWE-119
High · CVSS 7.5
EPSS 0.4% (30th pct)2026-06-16
Same-origin policy bypass in the Networking: Cookies component
CVE-2026-12304
Patch
CWE-346
Critical · CVSS 9.1
EPSS 0.2% (9th pct)2026-06-16
Mitigation bypass in the DOM: Security component
CVE-2026-12302
Patch
CWE-693
Medium · CVSS 6.5
EPSS 0.2% (16th pct)2026-06-16
JIT miscompilation in the DOM: Core & HTML component
CVE-2026-12299
Patch
CWE-843
High · CVSS 7.5
EPSS 0.3% (23th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12298
Patch
CWE-125
High · CVSS 7.5
EPSS 0.3% (23th pct)2026-06-16
Sandbox escape due to incorrect boundary conditions in the Networking component
CVE-2026-12297
Patch
CWE-119
Critical · CVSS 9.6
EPSS 0.4% (32th pct)2026-06-16
Sandbox escape in the Security: Process Sandboxing component
CVE-2026-12296
Patch
CWE-693
Critical · CVSS 9.6
EPSS 0.4% (32th pct)2026-06-16
Sandbox escape in the DOM: Navigation component
CVE-2026-12295
Patch
CWE-693
Critical · CVSS 9.6
EPSS 0.4% (32th pct)2026-06-16
Sandbox escape in the DOM: Workers component
CVE-2026-12294
Patch
CWE-693
Critical · CVSS 9.6
EPSS 0.4% (29th pct)2026-06-16
Incorrect boundary conditions in the Web Audio component
CVE-2026-12292
Patch
CWE-119
High · CVSS 8.1
EPSS 0.4% (32th pct)2026-06-16
Use-after-free in the Networking: HTTP component
CVE-2026-12291
Patch
CWE-416
High · CVSS 8.8
EPSS 0.4% (30th pct)2026-06-16
Memory safety bug fixed in Firefox 152
CVE-2026-12290
Patch
CWE-119
High · CVSS 8.1
EPSS 0.4% (32th pct)2026-06-16
Privilege escalation in the Graphics: WebRender component
CVE-2026-12289
Patch
CWE-269
High · CVSS 8.8
EPSS 0.4% (32th pct)2026-06-16
Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151
CVE-2026-8975
Patch
CWE-119
High · CVSS 8.8
EPSS 0.4% (35th pct)2026-05-19

Showing 30 of 1,153

Common weakness types

The CWE weakness categories most often found in Debian firefox-esr CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Debian firefox-esr CVEs were published each year.

2007

2016

108

2017

2018

199

2019

2020

2021

2022

104

2023

112

2024

2025

100

2026

172

Other Debian products

Browse vulnerabilities for other products by Debian.

linux15,165 CVEs debian linux10,068 CVEs chromium3,665 CVEs linux-6.13,436 CVEs firefox1,942 CVEs thunderbird1,015 CVEs imagemagick812 CVEs wireshark750 CVEs

All Debian vulnerabilities

Frequently asked questions

Common questions about Debian firefox-esr vulnerabilities.

How many CVEs does Debian firefox-esr have?: Debian firefox-esr has 1,153 published CVE records since 2006.
How many Debian firefox-esr CVEs are in CISA KEV?: Yes — 11 of Debian firefox-esr's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Debian firefox-esr vulnerabilities?: Yes — 98 of Debian firefox-esr's CVEs have a known public exploit.
Which versions of Debian firefox-esr are affected?: 526 distinct Debian firefox-esr versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Debian firefox-esr CVEs?: Debian firefox-esr's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write), CWE-754 (Improper Check for Unusual or Exceptional Conditions).
How many critical Debian firefox-esr vulnerabilities are there?: Debian firefox-esr has 278 critical and 505 high-severity CVEs.
What is the average severity of Debian firefox-esr CVEs?: The average CVSS base score across Debian firefox-esr's scored CVEs is 7.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Debian firefox-esr vulnerabilities

Monitor new Debian firefox-esr vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing