CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
Mozilla has 4,248 CVEs, 13 exploited. Pick a weakness or a product to list them.
By weakness
- Memory Corruption1,459 · 10 exploited
- Access Control395 · 1 exploited
- Input Validation and Logic266 · 1 exploited
- Information Disclosure263
- Cross-site Scripting188
- Denial of Service184
- Misconfiguration and Insecure Design143
- Other weaknesses98
- Cryptography87
- Command and Code Injection80
- Authentication71
- Race Conditions70 · 1 exploited
- File and Path Handling51
- Open Redirect32
- Cross-Site Request Forgery30
- Injection and Smuggling29
- Deserialization and Object Injection9
- Supply Chain and Malicious Code8
- SQL Injection3
- Server-Side Request Forgery3
- No weakness recorded779
By product
- Firefox3,310 · 6 exploited
- Thunderbird352 · 2 exploited
- Firefox ESR154 · 3 exploited
- Bugzilla148
- Firefox for iOS63
- Mozilla44
- Seamonkey44
- Network Security Services22
- Thunderbird Esr15
- Firefox for Android13
- Focus for iOS12
- NSS11
- Firefox Os9
- Bonsai4
- Mozilla Bleach4
- Camino3
- convict3
- Netscape Portable Runtime3
- Geckodriver2
- Hubs Cloud2
- Mozilla VPN2
- WebThings Gateway2
- Bleach1
- common-voice1
- Durian Web Application Server1
- Firefox and Thunderbird1 · 1 exploited
- Firefox for1
- Firefoxos1
- Focus1
- Gecko1
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.