Every CVE Search/ Get API key

CVE-2026-113470

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

5.4 MediumFix available

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.46%Up 0.3 points since Oct 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Record
CVE-2026-113470
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2026-104991 5.4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Record
EUVD-2026-104991
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vr39-qqr3-x9v4 5.4

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October...

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.

Record
GHSA-vr39-qqr3-x9v4
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 5.4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Record
CVE-2026-113470
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVDEBIAN-CVE-2026-113470 5.4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Record
DEBIAN-CVE-2026-113470
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-4651 5.4

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.(CVE-2026-113470)

Record
OESA-2026-4651
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVOESA-2026-4652 5.4

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.(CVE-2026-113470)

Record
OESA-2026-4652
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-113470 5.4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Record
UBUNTU-CVE-2026-113470
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2026-0540 No score

Updated rootcerts & nss packages fix a security vulnerability

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. (CVE-2026-113470)

Record
MGASA-2026-0540
Updated
2026-11-02
OSVopenSUSE-SU-2026:12211-1 No score

firefox-esr-153.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-153.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12211-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12224-1 No score

MozillaThunderbird-153.5.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-153.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12224-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12259-1 No score

MozillaFirefox-158.0.1-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-158.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12259-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22159-1 No score

Security update for mozilla-nss, MozillaFirefox

This update for mozilla-nss, MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.5.1 ESR (MFSA 2026-112, bsc#1286385):

  • CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261).
Record
openSUSE-SU-2026:22159-1
Updated
2026-11-02
OSVSUSE-SU-2026:24412-1 No score

Security update for mozilla-nss, MozillaFirefox

This update for mozilla-nss, MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.5.1 ESR (MFSA 2026-112, bsc#1286385):

  • CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261).
Record
SUSE-SU-2026:24412-1
Updated
2026-11-02
OSVSUSE-SU-2026:4928-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-112, MFSA 2026-120, bsc#1286385):

  • CVE-2026-100801: Privilege escalation in the DLL Services component.
  • CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261).
  • CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component.
  • CVE-2026-117861: Sandbox escape in the DOM: Navigation component.
  • CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component.
  • CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component.
  • CVE-2026-117864: Sandbox escape in the Form Manager component.
  • CVE-2026-117865: Use-after-free in the JavaScript: GC component.
  • CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-117867: Use-after-free in the Layout component.
  • CVE-2026-117868: Sandbox escape in the DOM: Networking component.
  • CVE-2026-117869: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117870: Use-after-free in the JavaScript Engine component.
  • CVE-2026-117871: Invalid pointer in the Graphics component.
  • CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component.
  • CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component.
  • CVE-2026-117874: Use-after-free in the Internationalization component.
  • CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component.
  • CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component.
  • CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component.
  • CVE-2026-117880: Use-after-free in the XML component.
  • CVE-2026-117881: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117882: Use-after-free in the Layout component.
  • CVE-2026-117883: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-117884: Use-after-free in the Networking component.
  • CVE-2026-117885: Use-after-free in the Layout: Grid component.
  • CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component.
  • CVE-2026-117887: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component.
  • CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component.
  • CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component.
  • CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component.
  • CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component.
  • CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component.
  • CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component.
  • CVE-2026-117895: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117896: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component.
  • CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component.
  • CVE-2026-117899: Use-after-free in the Networking: HTTP component.
  • CVE-2026-117900: Use-after-free in the DOM: Editor component.
  • CVE-2026-117901: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-117903: Use-after-free in the Audio/Video component.
  • CVE-2026-117904: Use-after-free in the JavaScript: GC component.
  • CVE-2026-117905: Use-after-free in the Audio/Video: Playback component.
  • CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-117907: Use-after-free in the Networking component.
  • CVE-2026-117908: Use-after-free in the Graphics:…
Record
SUSE-SU-2026:4928-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Debian:12
 before 153.5.1esr-1~deb12u1, plus listed versions
102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1
Show 45 moreShow less
102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1
153.5.1esr-1~deb12u1
firefox-esr
Debian:13
 before 153.5.1esr-1~deb13u1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 45 moreShow less
140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.16.0esr-1140.16.0esr-1~deb12u1140.16.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1
153.5.1esr-1~deb13u1
firefox-esr
Debian:14
 before 153.5.1esr-1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 45 moreShow less
140.10.0esr-1140.10.0esr-1~deb11u1140.10.0esr-1~deb12u1140.10.0esr-1~deb13u1140.10.1esr-1140.10.1esr-1~deb11u1140.10.1esr-1~deb12u1140.10.1esr-1~deb13u1140.10.2esr-1140.10.2esr-1~deb11u1140.10.2esr-1~deb12u1140.10.2esr-1~deb13u1140.11.0esr-1140.11.0esr-1~deb11u1140.11.0esr-1~deb12u1140.11.0esr-1~deb13u1140.12.0esr-1140.12.0esr-1~deb11u1140.12.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1140.13.0esr-1~deb11u1140.13.0esr-1~deb12u1140.13.0esr-1~deb13u1140.13.0esr-2140.14.0esr-1~deb11u1140.14.0esr-1~deb12u1140.14.0esr-1~deb13u1140.14.0esr-2140.15.0esr-1140.15.0esr-1~deb12u1140.15.0esr-1~deb13u1140.16.0esr-1140.16.0esr-1~deb12u1140.16.0esr-1~deb13u1140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1
153.5.1esr-1
thunderbird
Debian:12
 before 1:153.5.1esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:153.5.1esr-1~deb12u1
thunderbird
Debian:13
 before 1:153.5.1esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1
1:153.5.1esr-1~deb13u1
thunderbird
Debian:14
 All versions, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 45 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1
 None known
rootcerts
Mageia:10
 before 20261020.00-1.mga10
20261020.00-1.mga10
nss
Mageia:10
 before 3.131.1-1.mga10
3.131.1-1.mga10
firefox
openEuler:24.03-LTS-SP3
 before 153.5.1-1.oe2403sp3
153.5.1-1.oe2403sp3
firefox
openEuler:24.03-LTS-SP4
 before 153.5.1-1.oe2403sp4
153.5.1-1.oe2403sp4
Show 18 moreShow less
Affected packages
PackageAffectedFixed
mozilla-nss
SUSE:Linux Micro 6.2
 before 3.125-160000.3.1
3.125-160000.3.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 147 CVEs
 before 153.6.0-118.19.2
153.6.0-118.19.2
MozillaFirefox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 147 CVEs
 before 153.6.0-118.19.2
153.6.0-118.19.2
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs102
Ubuntu:22.04:LTS
 All versions, plus listed versions
102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
mozjs91
Ubuntu:22.04:LTS
 All versions, plus listed versions
91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1
 None known
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
mozjs102
Ubuntu:24.04:LTS
 All versions, plus listed versions
102.15.1-1102.15.1-3ubuntu2
 None known
mozjs115
Ubuntu:24.04:LTS
 All versions, plus listed versions
115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4
Show 4 moreShow less
115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1
 None known
firefox-esr
openSUSE:Tumbleweed
 before 153.5.1-1.1
153.5.1-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 66 CVEs
 before 153.5.1-1.1
153.5.1-1.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 158.0.1-1.1
158.0.1-1.1
MozillaFirefox
openSUSE:Leap 16.0
 before 153.5.1-160000.1.1
153.5.1-160000.1.1
mozilla-nss
openSUSE:Leap 16.0
 before 3.125-160000.3.1
3.125-160000.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-113470 is a medium vulnerability (CVSS 5.4) in Mozilla Firefox, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in firefox-esr 153.5.1esr-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 547 versions, 48 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open