The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49922 advisory.

    [140.13.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [140.13.0]
    - Add OpenELA debranding

    [140.13.0-1]
    - Update to 140.13.0 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21519-1 advisory.

    - Update to Firefox Extended Support Release 140.13.0 ESR.
      - MFSA 2026-70 (bsc#1271649):
        * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
        * CVE-2026-15719: Site isolation issue in the DOM: Navigation component
        * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
        * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
        * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
        * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component
        * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component
        * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component
        * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component
        * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component
        * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component
        * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component
        * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component
        * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component
        * CVE-2026-16357: Incorrect boundary conditions in the Graphics component
        * CVE-2026-16371: Privilege escalation in the DOM: Navigation component
        * CVE-2026-16374: Information disclosure in the Framework component in DevTools
        * CVE-2026-16375: Site isolation issue in the Networking: HTTP component
        * CVE-2026-16377: Mitigation bypass in the PDF Viewer component
        * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component
        * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component
        * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component
        * CVE-2026-16383: Mitigation bypass in the DOM: Networking component
        * CVE-2026-16387: Site isolation issue in the Networking component
        * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
        * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component
        * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component
        * CVE-2026-16396: Privilege escalation in WebExtensions
        * CVE-2026-16405: Information disclosure in the Networking: WebSockets component
        * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
        * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
        * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13
    - Remove obsolete `mozilla-nss-certs` (bsc#1269226).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49922 advisory.

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49921 advisory.

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49621 advisory.

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:47101 advisory.

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
      * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
      * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component     (CVE-2026-16350)
      * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
      * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)
      * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
      * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
      * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)
      * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)
      * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
      * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox     153 (CVE-2026-16360)
      * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
      * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
      * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
      * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
      * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
      * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)
      * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
      * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
      * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
      * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
      * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
      * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
      * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
      * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
      * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
      * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53445 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:54180 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode     (CVE-2026-56208)

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:54259 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode     (CVE-2026-56208)

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:54248 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode     (CVE-2026-56208)

    * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

    * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

    * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

    * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

    * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16356)

    * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

    * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

    * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13     (CVE-2026-16361)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component     (CVE-2026-16352)

    * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component     (CVE-2026-16368)

    * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153     (CVE-2026-16360)

    * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

    * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

    * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

    * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

    * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

    * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component     (CVE-2026-16351)

    * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

    * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

    * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

    * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

    * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

    * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

    * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

    * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

    * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

    * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d71f89d7e advisory.

    - Update to latest upstream (153.0)

    ----

    - New upstream release (153.0)

    ----

    - Updated to latest upstream (153.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16355)

Note that Nessus relies on the presence of the package as reported by the vendor.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785839724 advisory.

  - The code to parse MIME headers for display when forwarding a message (if the setting to view all headers     was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer     for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and     Thunderbird 140.13. (CVE-2026-14899)

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird     140.13. (CVE-2026-15718)

  - We are aware that exploit code for this is public however we are not aware of any attacks in the wild     abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR     140.13, and Thunderbird 140.13. (CVE-2026-15719)

  - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,     Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16349)

  - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox     153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. (CVE-2026-16350)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
332093	Oracle Linux 8 : thunderbird (ELSA-2026-49922)	Nessus	Oracle Linux Local Security Checks	2026/8/5	2026/8/5	critical
332102	openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21519-1)	Nessus	SuSE Local Security Checks	2026/8/5	2026/8/5	critical
332990	RockyLinux 8 : thunderbird (RLSA-2026:49922)	Nessus	Rocky Linux Local Security Checks	2026/8/6	2026/8/6	critical
332999	RockyLinux 9 : thunderbird (RLSA-2026:49921)	Nessus	Rocky Linux Local Security Checks	2026/8/6	2026/8/6	critical
333003	RockyLinux 10 : thunderbird (RLSA-2026:49621)	Nessus	Rocky Linux Local Security Checks	2026/8/6	2026/8/6	critical
333103	AlmaLinux 10 : firefox (ALSA-2026:47101)	Nessus	Alma Linux Local Security Checks	2026/8/6	2026/8/6	critical
334546	RHEL 10 : thunderbird (RHSA-2026:53445)	Nessus	Red Hat Local Security Checks	2026/8/11	2026/8/11	critical
334847	RHEL 8 : firefox (RHSA-2026:54180)	Nessus	Red Hat Local Security Checks	2026/8/12	2026/8/12	critical
334958	RHEL 8 : firefox (RHSA-2026:54259)	Nessus	Red Hat Local Security Checks	2026/8/12	2026/8/12	critical
334960	RHEL 7 : firefox (RHSA-2026:54248)	Nessus	Red Hat Local Security Checks	2026/8/12	2026/8/12	critical
329269	Fedora 44 : firefox (2026-7d71f89d7e)	Nessus	Fedora Local Security Checks	2026/7/23	2026/8/28	critical
329445	Linux Distros Unpatched Vulnerability : CVE-2026-16355	Nessus	Misc.	2026/7/25	2026/8/12	critical
348282	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2026:4268-1)	Nessus	SuSE Local Security Checks	2026/9/19	2026/9/19	critical
352382	AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785839724)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical